Skip to content

WHOIS

Registration age, registrant changes, and registrar trust pulled from authoritative WHOIS records. Each signal carries the date, owner, or trust event that triggered it.

See 6 WHOIS signalsSee verdicts firing these
  • 6 named signals across 3 subgroups
  • Recomputed live per IOC, not pulled from a static feed
  • Every signal ships with evidence + 3-question Q&A trail
About

What WHOIS models

Tracks registration age, registrant changes, and registrar trust from authoritative WHOIS records.

What it models
Tracks registration age, registrant changes, and registrar trust from authoritative WHOIS records.
How it fires
Each signal carries the date, owner, or trust event that triggered it; registry-side facts, not heuristics.
Why it matters
Catches recently-registered campaign domains and registrant-pivot patterns that operators use to rotate infrastructure.
Subgroups

3 subgroups · 6 signals in WHOIS

Each subgroup bundles signals that share a mechanism: same evidence shape, same direction logic. Tap one to inspect its signal names; every name opens a leaf page with the underlying Q&A trail.

See subgroup detail
See subgroup detail
See subgroup detail
Verdict scenarios

How WHOIS shapes the call

Three real-world situations where this group's evidence dominates the decision. The verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A domain registered three days ago through a low-trust registrar, with privacy-protected registrant details and no historical ownership trail.

VerdictIQ explains

“Decline this domain. Fresh registration plus low-trust registrar plus opaque ownership is the standard launch profile for short-lived attack infrastructure. Hold until at least 30 days of clean history accumulate.”

Medium riskVERDICT · REVIEW
The situation

A domain that changed registrant ownership in the last 60 days after a multi-year stable history under a different operator.

VerdictIQ explains

“Send to analyst review. Ownership change after long stability often signals the domain was sold or repurposed; reputation built under the prior owner doesn't carry. Verify the new owner's intent before granting prior trust.”

Low riskVERDICT · ALLOW
The situation

A domain registered over five years ago through a top-tier registrar, with consistent organizational ownership and no recent registrant changes.

VerdictIQ explains

“Allow. The registration profile is mature and stable: long ownership history, reputable registrar, no churn. No WHOIS-side reason to delay.”

See full Verdict Gallery

See WHOIS signals fire on your data

Free tier: 100 IOCs/day, LLM layer included.

Start FreeOpen API reference