Skip to content

One-Off Popularity Rise

It indicates that the domain's PageRank time series contains a single interior point where the rank improved (numerically decreased) by more than the extreme_spike_ratio (default 100x) compared to the mean of its immediate neighbors, then returned to baseline. A one-time event could be a viral content moment, a temporary algorithm shift, or an isolated bot-driven inflation episode, useful as a weak indicator pending corroborating signals.

See verdicts firing this signalOpen in API reference
Also surfaces as:
Recurrent Popularity RisesOne-Off Popularity DropRecurrent Popularity Drops
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'One-Off Popularity Rise' mean in SOC analysis?

It indicates that the domain's PageRank time series contains a single interior point where the rank improved (numerically decreased) by more than the extreme_spike_ratio (default 100x) compared to the mean of its immediate neighbors, then returned to baseline. A one-time event could be a viral content moment, a temporary algorithm shift, or an isolated bot-driven inflation episode, useful as a weak indicator pending corroborating signals.

Why it matters02

What does 'Recurrent Popularity Rises' mean and why is it more suspicious than a single rise?

It signals that the domain produced two or more spike events (rank improving sharply then reverting) across the observed history. A single spike can be noise; a recurring pattern indicates systematic manipulation, periodic bot campaigns, recurring fake-backlink bursts, or coordinated traffic injection cycles. This sublabel carries higher confidence than single_rise.

How analysts use it03

What does 'One-Off Popularity Drop' mean in SOC analysis?

It indicates that the domain's PageRank time series contains a single interior point where the rank degraded (numerically increased) sharply compared to its neighbors and then returned. A one-off drop can be a temporary outage, regional ranking fluctuation, or a brief takedown event, informational unless combined with other negative signals.

Worth knowing04

What does 'Recurrent Popularity Drops' mean and why is it more suspicious than a single drop?

It indicates two or more periodic drops in the rank time series. Repeated transient drops often correspond to infrastructure on/off cycles, takedown-and-return campaigns, or coordinated traffic withdrawal windows, patterns characteristic of disposable or weaponized infrastructure.

Worth knowing05

How does popularity_spike_suspicious differ from popularity_trend_increase / decrease?

popularity_trend_increase / decrease compare only first_rank to last_rank, capturing overall multi-period trends. popularity_spike_suspicious scans every interior point against its neighbors and identifies transient one-step anomalies even when the overall first-to-last trend is stable. Single vs recurrent sublabels further distinguish noise from systematic manipulation.

Often paired with:alert_only
Evidence shape

What One-Off Popularity Rise looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "popularity_spike_suspicious",
  "name": "One-Off Popularity Rise",
  "group": "popularity_and_backlink",
  "subgroup": "popularity_score",
  "direction": "malicious",
  "evidence": {
    "tranco_rank": 482103,
    "tranco_rank_band": "100k-1m",
    "organic_traffic_band": "low",
    "regional_rank_top_country": "US"
  }
}
See in API reference
Siblings

Peers in Popularity Score

9 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

High-Reputation Domain

It refers to globally recognized, high-traffic domains with verified ownership and a long operational history, such as g…

SafeCore
Emerging Link Farm Pattern

A domain that is reachable from many distinct sources (high harmonic centrality) yet none of those sources carry meaning…

Malicious
Newly Broadly Reachable

It represents a domain that receives links from a large number of distinct sources (high harmonic centrality) but whose …

Safe
Newly Niche-Authoritative

A domain that is referenced by a small number of sources (mid or tail harmonic centrality) but those sources carry stron…

Safe
Show 5 more in Popularity Score
In the wild

See One-Off Popularity Rise fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to One-Off Popularity Rise. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to Popularity Score