This term refers to a web service (HTTP/HTTPS) that has been continuously active and reachable for a long duration without significant downtime. In SOC analysis, such long-lived HTTP services are typically associated with legitimate, well-maintained infrastructures, such as business websites, content delivery networks (CDNs), or long-established online platforms.
Three questions every analyst asks before acting on this signal.
This term refers to a web service (HTTP/HTTPS) that has been continuously active and reachable for a long duration without significant downtime. In SOC analysis, such long-lived HTTP services are typically associated with legitimate, well-maintained infrastructures, such as business websites, content delivery networks (CDNs), or long-established online platforms.
From a defensive or threat-hunting perspective, a long-lived HTTP service generally represents stability and lower risk. Malicious domains used in phishing, C2 communication, or exploit campaigns tend to have a short lifespan due to takedowns and reputation-based blocking. Therefore, sustained uptime over months or years is often viewed as an indicator of trustworthiness, though continuous monitoring is still recommended.
In SOC and threat intelligence contexts, 'Very Long-lived HTTP Service' refers to domains that have been operational for an exceptionally extended period—often multiple years—without significant configuration or IP changes. Such persistence typically aligns with legitimate enterprise infrastructure, but may also describe legacy or abandoned services that could become targets for future compromise.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_long_time_up_and_running",
"name": "Long-lived HTTP Service Detected",
"group": "http_crawling_history",
"subgroup": "http_availability_stability",
"direction": "safe",
"evidence": {
"uptime_30d_pct": 99.4,
"status_code_mode": 200,
"intermittent_failures_30d": 2,
"last_unreachable_days_ago": 14
}
}4 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain has recently started serving web content over HTTP or HTTPS after a long period of inactivi…
It indicates that the base domain’s web service (HTTP/HTTPS) is no longer responding or has gone offline. This behavior …
It refers to a domain that operates with restricted accessibility — its HTTP/HTTPS services are either protected, limite…
It refers to a domain whose HTTP or HTTPS service repeatedly switches between being online and offline within short time…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.