What it detects01
What does 'Stable MX Usage' indicate?
It shows the domain has been using the same mail exchange servers for an extended period, reflecting stable and predictable email infrastructure.
Stable MX Usage Long Term
It shows the domain has been using the same mail exchange servers for an extended period, reflecting stable and predictable email infrastructure.
Also surfaces as:
Stable MX Usage Consistent ProviderStable MX Usage Since Creation
Analyst Q&A
What this signal answers
The questions every analyst asks before acting on this signal.
Why it matters02
Why is MX stability important for SOC and CTI teams?
Threat actors frequently rotate MX setups or use disposable mail infrastructure. Long-term MX stability typically aligns with legitimate operational behavior and reduces suspicion in domain triage.
How analysts use it03
How should analysts use this signal?
Use MX stability as a supporting safe indicator. It doesn’t guarantee legitimacy but strengthens a low-risk assessment when combined with other benign signals.
Evidence shape
What Stable MX Usage Long Term looks like in the response
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
json
{
"slug": "stable_mx_usage",
"name": "Stable MX Usage Long Term",
"group": "dns_history",
"subgroup": "dns_records_mx_ns",
"direction": "safe",
"evidence": {
"ns_provider": "cloudflare.com",
"ns_provider_tier": "paid_public",
"ns_stability_days": 412,
"mx_provider": "google.com",
"mx_provider_tier": "paid_mail"
}
}Siblings
Peers in DNS Records (MX/NS)
12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
Stable NS Usage Long Term
It shows that the domain has maintained the same nameserver configuration without fluctuations, suggesting predictable a…
Safe
Self-Managed Mail Infrastructure Detected
It means the domain operates its own mail exchange (MX) servers instead of relying on trusted third-party providers like…
SafeCore
MX Unchanged Since Domain Creation
The domain's MX records have never been changed since registration, suggesting minimal email infrastructure management.
Malicious
Newly Self-Managed MX Server
The domain has recently set up its own mail exchange server within a short time window.
Malicious
In the wild
See Stable MX Usage Long Term fire on real IOCs
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
Open Verdict Gallery
Pre-filtered to Stable MX Usage Long Term. See real IOCs this signal caught and the verdicts the engine returned.
Latest reports carrying this signal
bmndx[.]comSuspicious66Verified 2026-08-01adiem[.]mxSuspicious61Verified 2026-08-01droppin[.]siteSuspicious60Verified 2026-08-01bro1[.]bizSuspicious63Verified 2026-08-01bleachinjectionuncommon[.]comSuspicious64Verified 2026-08-01emailnic[.]onlineSuspicious61Verified 2026-08-01bikkviz[.]comSuspicious62Verified 2026-08-01cardioplus[.]com[.]mxSuspicious66Verified 2026-08-01fullhdfilmizles[.]orgSuspicious63Verified 2026-08-01centralnetro[.]com[.]brSuspicious64Verified 2026-08-01click2[.]clubSuspicious60Verified 2026-08-01burcuorme[.]comSuspicious65Verified 2026-08-01goldenbook[.]aeSuspicious60Verified 2026-08-01ducat[.]kzSuspicious61Verified 2026-08-01brandwizer[.]co[.]inSuspicious68Verified 2026-08-01bity[.]wsSuspicious63Verified 2026-08-01cavisaoil[.]comSuspicious61Verified 2026-08-01dropps[.]coSuspicious60Verified 2026-08-01donormix[.]comSuspicious64Verified 2026-08-01atomlines[.]comSuspicious64Verified 2026-08-01
Start free, in five minutes
1,000 verdicts/month on the free tier, LLM layer included. No card required.