It indicates that the base domain’s web service (HTTP/HTTPS) is no longer responding or has gone offline. This behavior typically appears when domains used in malicious operations are abandoned, deactivated, or taken down after detection. However, it can also occur with legitimate domains that have been retired, expired, or are under maintenance.
The questions every analyst asks before acting on this signal.
It indicates that the base domain’s web service (HTTP/HTTPS) is no longer responding or has gone offline. This behavior typically appears when domains used in malicious operations are abandoned, deactivated, or taken down after detection. However, it can also occur with legitimate domains that have been retired, expired, or are under maintenance.
Because requests to long-inactive or newly deactivated base domains often signal outdated configurations, infected endpoints trying to reconnect to old C2 servers, or threat actor cleanup activity. Monitoring traffic toward these domains helps analysts identify potential compromise remnants and legacy threat callbacks.
It describes a base domain that was recently operational but has become unresponsive at the HTTP level. In threat intelligence, such sudden downtime can indicate a domain being decommissioned after malicious use, taken down by defenders, or intentionally disabled by threat actors to evade detection.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_down_domain",
"name": "Inactive HTTP Service Detected (Base Domain)",
"group": "http_crawling_history",
"subgroup": "http_availability_stability",
"direction": "malicious",
"evidence": {
"uptime_30d_pct": 99.4,
"status_code_mode": 200,
"intermittent_failures_30d": 2,
"last_unreachable_days_ago": 14
}
}4 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It refers to a domain that operates with restricted accessibility, its HTTP/HTTPS services are either protected, limited…
This term refers to a web service (HTTP/HTTPS) that has been continuously active and reachable for a long duration witho…
It indicates that the domain has recently started serving web content over HTTP or HTTPS after a long period of inactivi…
It refers to a domain whose HTTP or HTTPS service repeatedly switches between being online and offline within short time…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
deeptechopportunities[.]comHigh82Verified 2026-08-01cryvantis[.]comHigh78Verified 2026-08-01cffcw[.]comSuspicious63Verified 2026-08-01atomproi[.]comHigh75Verified 2026-08-01dp787[.]comHigh76Verified 2026-08-01cloudflareaddons[.]comHigh78Verified 2026-08-01findcrew[.]orgHigh75Verified 2026-08-01eco-sales[.]ruSuspicious65Verified 2026-08-01auto-partse[.]techHigh75Verified 2026-08-01dropshipforge[.]shopHigh81Verified 2026-08-01arkinvst[.]comHigh76Verified 2026-08-01generaitiv[.]xyzSuspicious66Verified 2026-08-01freekoora4you[.]comHigh75Verified 2026-08-01dogem[.]netHigh79Verified 2026-08-01awhethexoic[.]shopHigh75Verified 2026-08-011drv[.]zoneHigh78Verified 2026-08-01displayfly[.]comSuspicious60Verified 2026-08-01cs-fl0at[.]comHigh83Verified 2026-08-01bqxy[.]netHigh76Verified 2026-08-01forma-host[.]lolHigh75Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.