It means that none of the commercial or open-source security vendors, such as antivirus engines, sandbox platforms, or threat intelligence providers, have classified or reported this domain as malicious. The domain maintains a clean reputation across all vendor datasets.
The questions every analyst asks before acting on this signal.
It means that none of the commercial or open-source security vendors, such as antivirus engines, sandbox platforms, or threat intelligence providers, have classified or reported this domain as malicious. The domain maintains a clean reputation across all vendor datasets.
Not necessarily. While the absence of vendor flags is a strong positive indicator, it does not guarantee absolute safety. New or dormant malicious domains may not yet have been detected or listed by security vendors.
This label supports a 'likely safe' assessment. SOC and CTI analysts can treat it as a confidence-boosting signal when corroborated by other benign features, such as consistent DNS history, stable hosting, and trusted SSL certificates.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "security_vendors_safe",
"name": "Not Flagged by Any Security Vendor",
"group": "threat_intelligence_feed",
"subgroup": "vendor_trust",
"direction": "safe",
"evidence": {
"trusted_vendor_count": 14,
"no_malware_references": true,
"last_clean_scan_days_ago": 2
}
}1 other signal shares the same subgroup. They detect related behaviors and often co-fire on the same IOC.
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
bbpayqianbao[.]comHigh82Verified 2026-08-01corplinetrade[.]comHigh77Verified 2026-08-01bfxxxvideo[.]orgHigh75Verified 2026-08-01cryy88[.]oneHigh77Verified 2026-08-01cryvpe[.]shopHigh77Verified 2026-08-01fifawereteyopc[.]ruHigh87Verified 2026-08-01edudex[.]ruHigh76Verified 2026-08-01dropped[.]topHigh78Verified 2026-08-0178maz[.]comHigh75Verified 2026-08-01biokdsl[.]comHigh84Verified 2026-08-01102988g8g8g[.]plHigh85Verified 2026-08-01cfcplane[.]comHigh81Verified 2026-08-0107207[.]winHigh79Verified 2026-08-01avmpmail[.]icuHigh77Verified 2026-08-01072397966[.]forumHigh76Verified 2026-08-01cryt[.]infoHigh78Verified 2026-08-01atomkzp[.]comHigh78Verified 2026-08-01evoolipxntvlj[.]shopHigh75Verified 2026-08-01071839659[.]forumHigh76Verified 2026-08-01fixuresrethink[.]cfdHigh75Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.