It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS provider. While legitimate organizations may self-host DNS for flexibility, threat actors often use this approach to maintain full control, obscure DNS changes, and avoid detection mechanisms.
The questions every analyst asks before acting on this signal.
It indicates that the domain operates using its own name server infrastructure rather than a reputable third-party DNS provider. While legitimate organizations may self-host DNS for flexibility, threat actors often use this approach to maintain full control, obscure DNS changes, and avoid detection mechanisms.
Because attackers can rapidly update DNS records, re-route traffic, or hide their infrastructure using self-controlled name servers. This behavior is common in phishing, command-and-control (C2), and malware delivery domains that require stealth and agility.
Recently created or switched self-managed NS infrastructure often signals preparation for a malicious campaign. Threat actors frequently deploy new NS configurations just before activating phishing or C2 operations to evade prior detection or blocklisting history.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "own_ns_usage",
"name": "Self-Managed Name Server Detected",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "safe",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like…
The domain has recently configured its own nameservers within a short time window.
It indicates that both IP and NS (nameserver) records of a domain are changing frequently, a behavior known as 'Double-F…
It indicates that the domain frequently changes its MX (Mail Exchange) records. Such behavior is often associated with s…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
cdnfree[.]orgSuspicious66Verified 2026-08-01deltainternet[.]net[.]brSuspicious62Verified 2026-08-01aj1985[.]onlineSuspicious62Verified 2026-08-01alegoomaster[.]comSuspicious61Verified 2026-08-01atalaianet[.]net[.]brSuspicious61Verified 2026-08-01azartnyjboy[.]comSuspicious62Verified 2026-08-01criogetikfenbut[.]orgSuspicious61Verified 2026-08-01frog[.]clSuspicious60Verified 2026-08-01cifo[.]co[.]idSuspicious63Verified 2026-08-01as262543[.]net[.]brSuspicious63Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.