It indicates that the domain is operated, controlled, or maintained by a known threat actor or cyber-criminal group. These domains are often part of a coordinated infrastructure used for phishing, malware distribution, or command-and-control operations.
Three questions every analyst asks before acting on this signal.
It indicates that the domain is operated, controlled, or maintained by a known threat actor or cyber-criminal group. These domains are often part of a coordinated infrastructure used for phishing, malware distribution, or command-and-control operations.
Identification is based on threat intelligence correlations, such as shared IP addresses, name-server patterns, SSL certificate reuse, or similar domain registration details. If multiple domains show these overlaps, they are likely managed by the same threat actor.
Because domains controlled by the same attacker group often evolve in clusters. Detecting one can lead to uncovering related domains, malware campaigns, and attack infrastructure, significantly improving proactive defense and attribution accuracy.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "managed_by_an_attacker_group",
"name": "Managed by an Attacker Group",
"group": "relational_intelligence",
"subgroup": "campaign_inference",
"direction": "malicious",
"evidence": {
"attributed_group": "campaign_q4_2025_a",
"confidence": 0.78,
"related_domains_count": 14,
"first_co_occurrence_days_ago": 22
}
}The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.