It indicates that the domain’s reputation, visibility, and traffic are steadily declining over time. This decay often precedes abandonment or repurposing, making the domain a common target for malicious reuse or reputation hijacking.
The questions every analyst asks before acting on this signal.
It indicates that the domain’s reputation, visibility, and traffic are steadily declining over time. This decay often precedes abandonment or repurposing, making the domain a common target for malicious reuse or reputation hijacking.
Because attackers often acquire or reactivate domains with decaying reputation to exploit their remaining trust signals. These domains may have once been legitimate, allowing threat actors to evade security filters that rely on historical reputation data.
Analysts should monitor for ownership changes, DNS record modifications, or newly issued SSL certificates. Combined with declining traffic, such changes often signal that the domain is being prepared for malicious reuse.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "popularity_trend_decrease",
"name": "Reputation Decay Domain",
"group": "popularity_and_backlink",
"subgroup": "popularity_trend",
"direction": "malicious",
"evidence": {
"trend_30d": "decrease",
"rank_delta_30d": -120000,
"inflection_detected": true,
"inflection_days_ago": 6
}
}1 other signal shares the same subgroup. They detect related behaviors and often co-fire on the same IOC.
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
0715jianzhan[.]comSuspicious70Verified 2026-08-01continueoraweb[.]comHigh78Verified 2026-08-01bqxy[.]netHigh76Verified 2026-08-01dp94[.]comHigh77Verified 2026-08-010energylighting[.]comHigh75Verified 2026-08-01aliyunga0017[.]comSuspicious62Verified 2026-08-01avmfuli[.]xyzSuspicious65Verified 2026-08-01freefoodaid[.]comSuspicious68Verified 2026-08-01de-tencentclb[.]netSuspicious61Verified 2026-08-01cfcphq[.]cnSuspicious60Verified 2026-08-01filmmodu16[.]comSuspicious68Verified 2026-08-01dp33[.]onlineSuspicious64Verified 2026-08-01cs-dada[.]comSuspicious73Verified 2026-08-01borgarab[.]comSuspicious67Verified 2026-08-01fullhdfilmizles[.]orgSuspicious63Verified 2026-08-01clcuahx[.]ruSuspicious64Verified 2026-08-01avmfinserv[.]comHigh78Verified 2026-08-01csd[.]linkSuspicious60Verified 2026-08-01bigolov[.]comSuspicious67Verified 2026-08-01broworker10s[.]comSuspicious65Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.