It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS provider. While legitimate organizations may self-host DNS for flexibility, threat actors often use this approach to maintain full control, obscure DNS changes, and avoid detection mechanisms.
Three questions every analyst asks before acting on this signal.
It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS provider. While legitimate organizations may self-host DNS for flexibility, threat actors often use this approach to maintain full control, obscure DNS changes, and avoid detection mechanisms.
Because attackers can rapidly update DNS records, re-route traffic, or hide their infrastructure using self-controlled name servers. This behavior is common in phishing, command-and-control (C2), and malware delivery domains that require stealth and agility.
Recently created or switched self-managed NS infrastructure often signals preparation for a malicious campaign. Threat actors frequently deploy new NS configurations just before activating phishing or C2 operations to evade prior detection or blocklisting history.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "own_ns_usage",
"name": "Self-Managed Name Server Detected",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "malicious",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}8 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like…
It indicates that both IP and NS (nameserver) records of a domain are changing frequently, a behavior known as 'Double-F…
It indicates that the domain frequently changes its MX (Mail Exchange) records. Such behavior is often associated with s…
It indicates that the domain is backed by a paid, reputable DNS provider rather than free or disposable nameservers. Thi…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.