It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often on abusive sites than on legitimate ones. The label is driven by which provider set the cookie, not by what the cookie stores.
The questions every analyst asks before acting on this signal.
It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often on abusive sites than on legitimate ones. The label is driven by which provider set the cookie, not by what the cookie stores.
It means two or more such provider cookies were observed on the same site, which strengthens the association compared to the basic tier.
This is a supporting malicious-context signal. The advanced tier carries more weight than the basic tier; both should be read together with redirector behavior, DNS volatility, parking monetization or threat intelligence indicators.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_risky_cookie_profile",
"name": "Basic Profiling Cookie Risk",
"group": "http_crawling_history",
"subgroup": "http_header_behaviors",
"direction": "malicious",
"evidence": {
"missing_security_headers": 4,
"cors_origin": "*",
"cors_credentials_allowed": true,
"provider_type": "self_hosted",
"risky_cookie_count": 2
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates abnormal HTTP redirection patterns such as instant refresh redirects, header-based redirects, forced interm…
The response does not come from a real site but from a domain parking, for-sale or traffic monetization platform: a park…
It indicates weak or overly permissive CORS configurations such as wildcard origins, broad method or header allowances, …
It indicates abnormal HTTP header structures such as unusually minimal or dense header sets, odd ordering, unexpected pr…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.