It indicates that the domain is running on a recognized enterprise or managed infrastructure stack, such as well-known application servers, managed hosting platforms, or cloud/CDN/WAF-fronted environments. These stacks typically exhibit stable, standardized, and professionally operated HTTP behavior with low abuse prevalence.
The questions every analyst asks before acting on this signal.
It indicates that the domain is running on a recognized enterprise or managed infrastructure stack, such as well-known application servers, managed hosting platforms, or cloud/CDN/WAF-fronted environments. These stacks typically exhibit stable, standardized, and professionally operated HTTP behavior with low abuse prevalence.
It describes an advanced enterprise-grade HTTP stack where server banners, proxy layers, security headers, and behavioral consistency are tightly controlled and hardened, reflecting mature operational and security practices.
This label provides a strong safe-context signal that lowers suspicion for commodity web abuse and phishing infrastructure, but it should always be evaluated alongside explicit malicious indicators.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "enterprise_stack_safe_profile",
"name": "Basic Enterprise Stack",
"group": "http_crawling_history",
"subgroup": "http_header_behaviors",
"direction": "safe",
"evidence": {
"missing_security_headers": 4,
"cors_origin": "*",
"cors_credentials_allowed": true,
"provider_type": "self_hosted",
"risky_cookie_count": 2
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It identifies who actually serves the domain: a CDN, a managed website platform, a free hosting platform, a security pro…
It indicates the domain returns a small but deliberate set of custom HTTP headers, which is typical of sites running on …
It indicates abnormal or inconsistent HTTP stack characteristics such as generic, rare, rapidly changing, or internally …
It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.