It identifies who actually serves the domain: a CDN, a managed website platform, a free hosting platform, a security product acting as a reverse proxy, or a self-hosted stack. The label is context rather than a verdict; it explains where a domain's other header evidence comes from.
The questions every analyst asks before acting on this signal.
It identifies who actually serves the domain: a CDN, a managed website platform, a free hosting platform, a security product acting as a reverse proxy, or a self-hosted stack. The label is context rather than a verdict; it explains where a domain's other header evidence comes from.
Many protective response headers are injected by the platform, not chosen by the site owner, so identical hardening evidence means very different things on a managed platform and on a self-hosted server. Free platforms also concentrate large populations of short-lived domains, which changes how other signals should be weighted.
Almost not at all, by design. It carries the lowest severity and impact in the set and all of its sublabels are informational, because naming the hosting provider is descriptive information rather than evidence of intent.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_infra_profile",
"name": "CDN Fronted",
"group": "http_crawling_history",
"subgroup": "http_header_behaviors",
"direction": "safe",
"evidence": {
"missing_security_headers": 4,
"cors_origin": "*",
"cors_credentials_allowed": true,
"provider_type": "self_hosted",
"risky_cookie_count": 2
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain is running on a recognized enterprise or managed infrastructure stack, such as well-known a…
It indicates the domain returns a small but deliberate set of custom HTTP headers, which is typical of sites running on …
It indicates abnormal or inconsistent HTTP stack characteristics such as generic, rare, rapidly changing, or internally …
It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.