It indicates that the domain has recently become active and started responding to DNS queries after a period of inactivity or recent registration. Such domains often appear in the early stages of phishing or malware campaigns, as attackers frequently use newly created infrastructure to avoid detection.
The questions every analyst asks before acting on this signal.
It indicates that the domain has recently become active and started responding to DNS queries after a period of inactivity or recent registration. Such domains often appear in the early stages of phishing or malware campaigns, as attackers frequently use newly created infrastructure to avoid detection.
Newly observed domains or IPs are often associated with emerging threats. Threat actors register and activate them shortly before launching attacks, such as phishing, C2 communications, or payload distribution. Therefore, tracking recently activated assets helps identify potential malicious activity before widespread abuse occurs.
Analysts cross-correlate DNS activation time with other indicators such as WHOIS creation date, SSL registration time, domain category, and historical reputation. A newly activated domain with little reputation and low traffic is more suspicious compared to legitimate services undergoing planned launches.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "ip_short_time_up_and_running",
"name": "Newly-Activated Domain",
"group": "dns_history",
"subgroup": "ip_stability_retention",
"direction": "malicious",
"evidence": {
"current_ip_lifespan_days": 612,
"median_ip_lifespan_days": 540,
"ip_churn_30d": 1,
"last_ip_change_days_ago": 612
}
}8 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
These refer to domains that have consistently resolved through DNS over a long period. Long-lived DNS activity often ind…
It means the domain operates on an IP address that is not shared with any other unrelated domains. This indicates a dedi…
It indicates that the domain has maintained the same IP address or hosting infrastructure for an extended period, weeks,…
It refers to domains that have not been active or resolvable through DNS for an extended period. Dead domains often indi…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
allowandgo[.]comSuspicious65Verified 2026-08-01fedra[.]infoSuspicious68Verified 2026-08-01avmn99[.]comSuspicious63Verified 2026-08-0107244[.]vipSuspicious63Verified 2026-08-01emailbounce[.]nlSuspicious60Verified 2026-08-01certified-toolbar[.]comSuspicious62Verified 2026-08-01follower[.]geSuspicious63Verified 2026-08-01checkass[.]monsterSuspicious67Verified 2026-08-01glaiwhee[.]netSuspicious61Verified 2026-08-01bleachinjectionuncommon[.]comSuspicious64Verified 2026-08-01bohemetulum[.]comSuspicious60Verified 2026-08-01allium[.]topSuspicious61Verified 2026-08-01ahoravideo-cdn[.]xyzSuspicious64Verified 2026-08-01de-tencentclb[.]netSuspicious61Verified 2026-08-01070962[.]xyzSuspicious64Verified 2026-08-01dp005[.]comSuspicious60Verified 2026-08-01dacewebsolutions[.]comSuspicious60Verified 2026-08-01daintybella[.]shopSuspicious63Verified 2026-08-01excursiionline[.]roSuspicious64Verified 2026-08-01bity[.]wsSuspicious63Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.