It indicates that before being classified as malicious, the domain was previously categorized under a risky or suspicious category — such as domain parking, newly registered, or suspicious hosting. This historical context increases the domain’s overall malicious likelihood.
Three questions every analyst asks before acting on this signal.
It indicates that before being classified as malicious, the domain was previously categorized under a risky or suspicious category — such as domain parking, newly registered, or suspicious hosting. This historical context increases the domain’s overall malicious likelihood.
Domains often transition from benign or parked states to active malicious operations. Historical categorization in a risky group (e.g., 'Domain Parking' or 'Uncategorized Newly Registered') may reveal early-stage setup activity of threat actors.
SOC and CTI analysts can leverage this as a strong contextual signal for behavioral correlation. When a domain shows a previously risky classification, it should trigger closer inspection or higher risk weighting in automated scoring systems.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "last_category_risky",
"name": "Previously Risky Category Detected",
"group": "threat_intelligence_feed",
"subgroup": "fraud_abuse",
"direction": "malicious",
"evidence": {
"category": "phishing",
"tld_trust": "untrusted",
"tld": ".zip",
"fraud_indicators": [
"typo_squatting",
"brand_impersonation"
]
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It refers to a domain that visually or semantically resembles a legitimate brand or organization’s domain. Such domains …
It indicates that the domain belongs to a top-level domain (TLD) frequently associated with malicious or fraudulent acti…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.