It indicates the presence of well-known, legitimate web analytics and reporting mechanisms, such as standard analytics cookies and clean reporting headers, commonly used by professional and non-abusive websites.
The questions every analyst asks before acting on this signal.
It indicates the presence of well-known, legitimate web analytics and reporting mechanisms, such as standard analytics cookies and clean reporting headers, commonly used by professional and non-abusive websites.
It means the site shows a small number of standard measurement signals, such as common analytics cookies, clean reporting endpoints or measurement headers. This is informational context only and carries little weight on its own.
It represents analytics usage that is coherently integrated with user sessions, reflecting intentional measurement rather than aggressive or covert tracking behavior.
This is a safe-context signal that lowers suspicion for tracking-related abuse. It should be used to balance risk scoring but must not outweigh explicit malicious indicators.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "legitimate_analytics_profile",
"name": "Basic Legit Analytics",
"group": "http_crawling_history",
"subgroup": "http_header_behaviors",
"direction": "safe",
"evidence": {
"missing_security_headers": 4,
"cors_origin": "*",
"cors_credentials_allowed": true,
"provider_type": "self_hosted",
"risky_cookie_count": 2
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often…
It identifies who actually serves the domain: a CDN, a managed website platform, a free hosting platform, a security pro…
The response does not come from a real site but from a domain parking, for-sale or traffic monetization platform: a park…
It indicates the domain returns a small but deliberate set of custom HTTP headers, which is typical of sites running on …
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.