It refers to a domain whose HTTP or HTTPS service repeatedly switches between being online and offline within short time intervals. While legitimate domains typically maintain consistent uptime, such instability is often observed in malicious infrastructures designed to evade detection or control access dynamically.
The questions every analyst asks before acting on this signal.
It refers to a domain whose HTTP or HTTPS service repeatedly switches between being online and offline within short time intervals. While legitimate domains typically maintain consistent uptime, such instability is often observed in malicious infrastructures designed to evade detection or control access dynamically.
Because threat actors frequently use unstable or short-lived hosting setups to avoid automated scanning, takedown actions, or forensic investigation. These servers may only be brought online during active campaigns, distributing malicious payloads or acting as temporary C2 nodes. The frequent up/down pattern is a strong indicator of potential malicious activity.
Yes, in rare cases. Small websites, testing environments, or misconfigured servers can exhibit intermittent availability due to maintenance or resource limits. Therefore, this indicator should be correlated with other threat signals (e.g., domain reputation, registration age, or external link behavior) before making a definitive judgment.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_often_up_and_down",
"name": "Unstable or Intermittent HTTP Service Detected",
"group": "http_crawling_history",
"subgroup": "http_availability_stability",
"direction": "malicious",
"evidence": {
"uptime_30d_pct": 99.4,
"status_code_mode": 200,
"intermittent_failures_30d": 2,
"last_unreachable_days_ago": 14
}
}4 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
This term refers to a web service (HTTP/HTTPS) that has been continuously active and reachable for a long duration witho…
It indicates that the base domain’s web service (HTTP/HTTPS) is no longer responding or has gone offline. This behavior …
It indicates that the domain has recently started serving web content over HTTP or HTTPS after a long period of inactivi…
It refers to a domain that operates with restricted accessibility, its HTTP/HTTPS services are either protected, limited…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
4bike[.]netSuspicious67Verified 2026-08-01gov-hr-no-reply[.]orgSuspicious63Verified 2026-08-01docu-duplicator[.]comSuspicious64Verified 2026-08-0107199[.]ukSuspicious62Verified 2026-08-01elpyp44pyple[.]comSuspicious71Verified 2026-08-01globalworkevents[.]comSuspicious72Verified 2026-08-01appfree[.]clubSuspicious65Verified 2026-08-01diakimnea[.]comSuspicious64Verified 2026-08-01accountaccess[.]orgSuspicious65Verified 2026-08-012i[.]nuSuspicious66Verified 2026-08-01bitdefenderupdate[.]orgSuspicious67Verified 2026-08-01awandata[.]ccSuspicious61Verified 2026-08-01arshera[.]techSuspicious72Verified 2026-08-01gmai[.]comSuspicious60Verified 2026-08-01crzz2[.]boatsSuspicious64Verified 2026-08-01chrome-extesions[.]comSuspicious61Verified 2026-08-01broworker4s[.]comSuspicious64Verified 2026-08-01emailpro[.]vnSuspicious60Verified 2026-08-0140gmail[.]comSuspicious60Verified 2026-08-01gmeil[.]comSuspicious65Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.