It indicates that the domain receives a large number of backlinks from diverse external sources across the internet. This often reflects high popularity or trustworthiness and is a common pattern among legitimate websites such as news platforms or social media domains.
Three questions every analyst asks before acting on this signal.
It indicates that the domain receives a large number of backlinks from diverse external sources across the internet. This often reflects high popularity or trustworthiness and is a common pattern among legitimate websites such as news platforms or social media domains.
The threshold is defined based on statistical analysis of global backlink distributions. This value is derived from large-scale data studies and used as a fixed reference point in analysis. Domains exceeding this statistically established threshold are flagged as having a high number of inbound links, allowing analysts to distinguish between natural link growth and potential link manipulation or spam-like behavior.
Yes. Although rare, some malicious actors artificially generate backlinks to appear reputable or to manipulate search rankings. Therefore, a high number of inbound links alone does not guarantee legitimacy—it must be correlated with other indicators such as domain age, registration behavior, and historical threat intelligence data.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "a_lot_of_inlink",
"name": "High Number of Inbound Links",
"group": "relational_intelligence",
"subgroup": "web_relational_infra",
"direction": "safe",
"evidence": {
"inlink_count": 312,
"malicious_outlink_count": 4,
"visited_by_malicious_count": 2,
"backlink_quality": "mixed"
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain was contacted or interacted with by a known malicious domain during the same session or act…
It refers to outbound links on a webpage that point to malicious or restricted domains. These links are often injected i…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.