It indicates that the base domain’s web service (HTTP/HTTPS) is no longer responding or has gone offline. This behavior typically appears when domains used in malicious operations are abandoned, deactivated, or taken down after detection. However, it can also occur with legitimate domains that have been retired, expired, or are under maintenance.
Three questions every analyst asks before acting on this signal.
It indicates that the base domain’s web service (HTTP/HTTPS) is no longer responding or has gone offline. This behavior typically appears when domains used in malicious operations are abandoned, deactivated, or taken down after detection. However, it can also occur with legitimate domains that have been retired, expired, or are under maintenance.
Because requests to long-inactive or newly deactivated base domains often signal outdated configurations, infected endpoints trying to reconnect to old C2 servers, or threat actor cleanup activity. Monitoring traffic toward these domains helps analysts identify potential compromise remnants and legacy threat callbacks.
It describes a base domain that was recently operational but has become unresponsive at the HTTP level. In threat intelligence, such sudden downtime can indicate a domain being decommissioned after malicious use, taken down by defenders, or intentionally disabled by threat actors to evade detection.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_down_domain",
"name": "Inactive HTTP Service Detected (Base Domain)",
"group": "http_crawling_history",
"subgroup": "http_availability_stability",
"direction": "malicious",
"evidence": {
"uptime_30d_pct": 99.4,
"status_code_mode": 200,
"intermittent_failures_30d": 2,
"last_unreachable_days_ago": 14
}
}4 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It refers to a domain that operates with restricted accessibility — its HTTP/HTTPS services are either protected, limite…
This term refers to a web service (HTTP/HTTPS) that has been continuously active and reachable for a long duration witho…
It indicates that the domain has recently started serving web content over HTTP or HTTPS after a long period of inactivi…
It refers to a domain whose HTTP or HTTPS service repeatedly switches between being online and offline within short time…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.