A domain whose harmonic centrality places it in the deep tail (very few distinct sources link to it) while PageRank is also in the mid-to-tail range. Two independent link-graph metrics simultaneously indicate isolation, which is typical for throwaway phishing infrastructure, orphan C2 nodes, or disposable hosting flips.
The questions every analyst asks before acting on this signal.
A domain whose harmonic centrality places it in the deep tail (very few distinct sources link to it) while PageRank is also in the mid-to-tail range. Two independent link-graph metrics simultaneously indicate isolation, which is typical for throwaway phishing infrastructure, orphan C2 nodes, or disposable hosting flips.
Transient indicates the isolation pattern is observed only in the latest period, could be a freshly registered domain or a temporary visibility dip. Persistent means the domain has stayed isolated across at least persistent_min_count consecutive periods, supporting the interpretation of intentionally hidden or orphan infrastructure.
When both harmonic_pos and pr_pos are simultaneously in deep-tail territory (default >=100M each), the label payload's details field includes a both_deep flag and the underlying rank values. Downstream consumers can use this for higher-confidence isolation interpretation independent of the persistence sublabel.
bad_popularity is driven by PageRank only and fires when a domain sits in the PR deep tail regardless of harmonic centrality. narrow_reach fires when harmonic is in deep tail AND PR is in mid-to-tail range, covering the PR 10M-50M population that bad_popularity misses. The guard ensures the two labels never co-fire, eliminating amplification double counting.
Yes, newly registered legitimate domains may not yet have any inbound links and can fall into the isolated zone, typically with the transient sublabel. The scoring amplification mechanism is designed for exactly this: with no malicious co-signals present, the base impact remains very low (0.1) and the label stays informational. Persistent narrow reach combined with malicious co-signals escalates the score significantly.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "narrow_reach",
"name": "Recently Isolated Domain",
"group": "popularity_and_backlink",
"subgroup": "popularity_score",
"direction": "malicious",
"evidence": {
"tranco_rank": 482103,
"tranco_rank_band": "100k-1m",
"organic_traffic_band": "low",
"regional_rank_top_country": "US"
}
}9 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
A domain that is reachable from many distinct sources (high harmonic centrality) yet none of those sources carry meaning…
It represents a domain that receives links from a large number of distinct sources (high harmonic centrality) but whose …
A domain that is referenced by a small number of sources (mid or tail harmonic centrality) but those sources carry stron…
It refers to globally recognized, high-traffic domains with verified ownership and a long operational history, such as g…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
atomproi[.]comHigh75Verified 2026-08-01dpages[.]siteSuspicious64Verified 2026-08-01fabricic[.]comSuspicious73Verified 2026-08-01childrensdolls[.]comSuspicious63Verified 2026-08-01filemix-1[.]comSuspicious68Verified 2026-08-01canvascascade[.]siteSuspicious68Verified 2026-08-01blockchain-newtech[.]comSuspicious69Verified 2026-08-01bwmyga[.]comSuspicious69Verified 2026-08-01droppin[.]siteSuspicious60Verified 2026-08-0178jj[.]xyzSuspicious60Verified 2026-08-01globalworkevents[.]comSuspicious72Verified 2026-08-01api1-meta[.]comSuspicious66Verified 2026-08-01b29[.]betSuspicious63Verified 2026-08-01alexscan[.]netSuspicious65Verified 2026-08-01dp67161914[.]comSuspicious61Verified 2026-08-01bayraksigorta[.]com[.]trSuspicious62Verified 2026-08-01cfbqjs[.]comSuspicious65Verified 2026-08-01droppy[.]xyzSuspicious63Verified 2026-08-01frebough[.]comHigh76Verified 2026-08-01070620[.]xyzSuspicious64Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.