It means that none of the commercial or open-source security vendors — such as antivirus engines, sandbox platforms, or threat intelligence providers — have classified or reported this domain as malicious. The domain maintains a clean reputation across all vendor datasets.
Three questions every analyst asks before acting on this signal.
It means that none of the commercial or open-source security vendors — such as antivirus engines, sandbox platforms, or threat intelligence providers — have classified or reported this domain as malicious. The domain maintains a clean reputation across all vendor datasets.
Not necessarily. While the absence of vendor flags is a strong positive indicator, it does not guarantee absolute safety. New or dormant malicious domains may not yet have been detected or listed by security vendors.
This label supports a 'likely safe' assessment. SOC and CTI analysts can treat it as a confidence-boosting signal when corroborated by other benign features, such as consistent DNS history, stable hosting, and trusted SSL certificates.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "security_vendors_safe",
"name": "Not Flagged by Any Security Vendor",
"group": "threat_intelligence_feed",
"subgroup": "vendor_trust",
"direction": "safe",
"evidence": {
"trusted_vendor_count": 14,
"no_malware_references": true,
"last_clean_scan_days_ago": 2
}
}1 other signal shares the same subgroup. They detect related behaviors and often co-fire on the same IOC.
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.