It indicates that the domain belongs to a top-level domain (TLD) frequently associated with malicious or fraudulent activity. Such TLDs are often exploited by threat actors because they are low-cost, offer weak registration verification, or are managed by registrars with minimal abuse handling.
Three questions every analyst asks before acting on this signal.
It indicates that the domain belongs to a top-level domain (TLD) frequently associated with malicious or fraudulent activity. Such TLDs are often exploited by threat actors because they are low-cost, offer weak registration verification, or are managed by registrars with minimal abuse handling.
Some TLDs—such as .xyz, .top, .club or .tk—are statistically overrepresented in phishing, malware distribution, and spam campaigns. Their abuse rates are significantly higher due to the ease of anonymous registration and poor registrar oversight.
Yes. While many malicious domains use these TLDs, not all are harmful. However, traffic or communication with such domains should trigger heightened scrutiny, especially when correlated with other malicious indicators such as newly registered status or suspicious hosting patterns.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "untrusted_tld",
"name": "High-Risk TLD Zone Detected",
"group": "threat_intelligence_feed",
"subgroup": "fraud_abuse",
"direction": "malicious",
"evidence": {
"category": "phishing",
"tld_trust": "untrusted",
"tld": ".zip",
"fraud_indicators": [
"typo_squatting",
"brand_impersonation"
]
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It refers to a domain that visually or semantically resembles a legitimate brand or organization’s domain. Such domains …
It indicates that before being classified as malicious, the domain was previously categorized under a risky or suspiciou…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.