It means the domain hosts a large number of subpages and internal links, forming a structured and content-rich website. This pattern is typical for legitimate, business-oriented, or long-standing domains.
The questions every analyst asks before acting on this signal.
It means the domain hosts a large number of subpages and internal links, forming a structured and content-rich website. This pattern is typical for legitimate, business-oriented, or long-standing domains.
Because building and maintaining many interlinked pages requires time, effort, and resources, something threat actors rarely invest in. Multi-page domains typically reflect legitimate operations focused on usability and SEO visibility.
It helps analysts distinguish between benign domains and short-lived, single-purpose malicious sites. A multi-page web infrastructure supports a high-confidence assessment of legitimacy and organizational stability.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "rich_subpage_info",
"name": "Multi-Page Web Infrastructure",
"group": "http_crawling_history",
"subgroup": "page_template_content",
"direction": "safe",
"evidence": {
"template_hash": "tpl_8c4f12",
"content_word_count": 1843,
"subpage_count": 64,
"content_richness": "rich"
}
}4 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It means the domain hosts only a few subpages or internal links. This pattern is commonly observed in malicious infrastr…
It means that the domain’s homepage contains a sufficient amount of structured, relevant, and well-presented web content…
It means that the domain’s homepage contains a very small amount of textual or visual content. Such minimal pages may in…
It refers to a website that displays the default or placeholder page of a known web technology, such as 'Apache Default …
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
albatros[.]uzSuspicious63Verified 2026-08-01fug[.]azSuspicious65Verified 2026-08-01adiem[.]mxSuspicious61Verified 2026-08-01adilachocolaterie[.]comSuspicious62Verified 2026-08-01alexscan[.]netSuspicious65Verified 2026-08-01atomlines[.]comSuspicious64Verified 2026-08-01071360[.]comSuspicious61Verified 2026-08-01cs-ch[.]comSuspicious64Verified 2026-08-01articles[.]skSuspicious60Verified 2026-08-01emailpro[.]vnSuspicious60Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.