Skip to content

Mostly Abandoned Subdomains

A significant portion of the domain's subdomains are offline or unreachable.

See verdicts firing this signalOpen in API reference
Also surfaces as:
Partially Abandoned Subdomains
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'Abandoned Subdomain' indicate?

A significant portion of the domain's subdomains are offline or unreachable.

Why it matters02

What distinguishes mostly vs partially abandoned?

Mostly abandoned (80%+ down, 3+ subdomains) strongly suggests domain neglect or expired domain takeover.

How analysts use it03

How should analysts use this in investigations?

Cross-reference with domain age, WHOIS changes, and registration patterns.

Often paired with:alert_only
Evidence shape

What Mostly Abandoned Subdomains looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "abandoned_subdomain",
  "name": "Mostly Abandoned Subdomains",
  "group": "dns_history",
  "subgroup": "domain_lifecycle",
  "direction": "malicious",
  "evidence": {
    "first_seen_days_ago": 4,
    "activation_event": "newly_resolved",
    "dormancy_days_before": 0,
    "registered_days_ago": 7
  }
}
See in API reference
Siblings

Peers in Domain Lifecycle

4 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Reputation Hijacked Domain

It refers to a domain that previously maintained a clean reputation and was considered safe, but has later been repurpos…

MaliciousCore
Newly-Activated Subdomain

It indicates that one or more subdomains under a given domain have recently become active or resolvable in DNS. This pat…

Malicious
Newly-Associated IP

It indicates that the domain has started resolving to a new IP address for the first time. This event often marks a chan…

Malicious
Subdomain-Only Active Domain

It refers to domains where only subdomains are active and the apex (root) domain does not serve any content or DNS respo…

Malicious
In the wild

See Mostly Abandoned Subdomains fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to Mostly Abandoned Subdomains. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to Domain Lifecycle