It indicates that the domain’s reputation, visibility, and traffic are steadily declining over time. This decay often precedes abandonment or repurposing, making the domain a common target for malicious reuse or reputation hijacking.
Three questions every analyst asks before acting on this signal.
It indicates that the domain’s reputation, visibility, and traffic are steadily declining over time. This decay often precedes abandonment or repurposing, making the domain a common target for malicious reuse or reputation hijacking.
Because attackers often acquire or reactivate domains with decaying reputation to exploit their remaining trust signals. These domains may have once been legitimate, allowing threat actors to evade security filters that rely on historical reputation data.
Analysts should monitor for ownership changes, DNS record modifications, or newly issued SSL certificates. Combined with declining traffic, such changes often signal that the domain is being prepared for malicious reuse.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "popularity_trend_decrease",
"name": "Reputation Decay Domain",
"group": "popularity_and_backlink",
"subgroup": "popularity_trend",
"direction": "malicious",
"evidence": {
"trend_30d": "decrease",
"rank_delta_30d": -120000,
"inflection_detected": true,
"inflection_days_ago": 6
}
}1 other signal shares the same subgroup. They detect related behaviors and often co-fire on the same IOC.
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.