It indicates that the domain belongs to a top-level domain (TLD) frequently associated with malicious or fraudulent activity. Such TLDs are often exploited by threat actors because they are low-cost, offer weak registration verification, or are managed by registrars with minimal abuse handling.
The questions every analyst asks before acting on this signal.
It indicates that the domain belongs to a top-level domain (TLD) frequently associated with malicious or fraudulent activity. Such TLDs are often exploited by threat actors because they are low-cost, offer weak registration verification, or are managed by registrars with minimal abuse handling.
Some TLDs, such as .xyz, .top, .club or .tk, are statistically overrepresented in phishing, malware distribution, and spam campaigns. Their abuse rates are significantly higher due to the ease of anonymous registration and poor registrar oversight.
Yes. While many malicious domains use these TLDs, not all are harmful. However, traffic or communication with such domains should trigger heightened scrutiny, especially when correlated with other malicious indicators such as newly registered status or suspicious hosting patterns.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "untrusted_tld",
"name": "High-Risk TLD Zone Detected",
"group": "threat_intelligence_feed",
"subgroup": "fraud_abuse",
"direction": "malicious",
"evidence": {
"category": "phishing",
"tld_trust": "untrusted",
"tld": ".zip",
"fraud_indicators": [
"typo_squatting",
"brand_impersonation"
]
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It refers to a domain that visually or semantically resembles a legitimate brand or organization’s domain. Such domains …
It indicates that before being classified as malicious, the domain was previously categorized under a risky or suspiciou…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
070962[.]xyzSuspicious64Verified 2026-08-01071433[.]xyzSuspicious64Verified 2026-08-0107244[.]vipSuspicious63Verified 2026-08-010721onani[.]xyzSuspicious65Verified 2026-08-01atomixnewyork[.]clubHigh81Verified 2026-08-0107131[.]vipSuspicious65Verified 2026-08-01adil88slot[.]siteSuspicious63Verified 2026-08-01fairu-schnellvpn[.]xyzSuspicious69Verified 2026-08-01070448[.]xyzSuspicious67Verified 2026-08-01cs-help[.]onlineHigh80Verified 2026-08-01edgeaccelerator[.]xyzSuspicious67Verified 2026-08-01deeptech-net[.]onlineHigh78Verified 2026-08-01cryto[.]vipHigh77Verified 2026-08-01appfree[.]clubSuspicious65Verified 2026-08-01dpages[.]siteSuspicious64Verified 2026-08-01dragonair[.]xyzSuspicious68Verified 2026-08-01070631[.]xyzSuspicious61Verified 2026-08-01avmiss[.]xyzSuspicious65Verified 2026-08-01atomicusers[.]xyzSuspicious61Verified 2026-08-01avnvtuan2[.]xyzSuspicious63Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.