It represents a domain that belongs to a globally recognized and reputable organization. These domains are considered highly trustworthy due to verified ownership, long-term stability, and consistent use of industry-standard security measures such as valid SSL certificates and secure DNS configurations.
Three questions every analyst asks before acting on this signal.
It represents a domain that belongs to a globally recognized and reputable organization. These domains are considered highly trustworthy due to verified ownership, long-term stability, and consistent use of industry-standard security measures such as valid SSL certificates and secure DNS configurations.
Because domains of established brands are continuously monitored, actively maintained, and backed by professional security teams. Their long operational history, stable reputation, and strong web presence make them low-risk assets within SOC evaluations.
It allows analysts to confirm legitimate traffic and reduce false positives during security investigations. Recognizing trusted domains ensures that benign connections to reputable organizations are not misclassified as suspicious activity.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "well_known_brand",
"name": "Trusted Brand Domain",
"group": "popularity_and_backlink",
"subgroup": "brand_authority",
"direction": "safe",
"evidence": {
"brand_match": "top-1k",
"brand_name": "example",
"authority_score": 0.96,
"verified_official": true
}
}The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.