It refers to a domain whose HTTP or HTTPS service repeatedly switches between being online and offline within short time intervals. While legitimate domains typically maintain consistent uptime, such instability is often observed in malicious infrastructures designed to evade detection or control access dynamically.
Three questions every analyst asks before acting on this signal.
It refers to a domain whose HTTP or HTTPS service repeatedly switches between being online and offline within short time intervals. While legitimate domains typically maintain consistent uptime, such instability is often observed in malicious infrastructures designed to evade detection or control access dynamically.
Because threat actors frequently use unstable or short-lived hosting setups to avoid automated scanning, takedown actions, or forensic investigation. These servers may only be brought online during active campaigns, distributing malicious payloads or acting as temporary C2 nodes. The frequent up/down pattern is a strong indicator of potential malicious activity.
Yes, in rare cases. Small websites, testing environments, or misconfigured servers can exhibit intermittent availability due to maintenance or resource limits. Therefore, this indicator should be correlated with other threat signals (e.g., domain reputation, registration age, or external link behavior) before making a definitive judgment.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_often_up_and_down",
"name": "Unstable or Intermittent HTTP Service Detected",
"group": "http_crawling_history",
"subgroup": "http_availability_stability",
"direction": "malicious",
"evidence": {
"uptime_30d_pct": 99.4,
"status_code_mode": 200,
"intermittent_failures_30d": 2,
"last_unreachable_days_ago": 14
}
}4 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
This term refers to a web service (HTTP/HTTPS) that has been continuously active and reachable for a long duration witho…
It indicates that the base domain’s web service (HTTP/HTTPS) is no longer responding or has gone offline. This behavior …
It indicates that the domain has recently started serving web content over HTTP or HTTPS after a long period of inactivi…
It refers to a domain that operates with restricted accessibility — its HTTP/HTTPS services are either protected, limite…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.