Skip to content
NewVerdictIQ Connector is here. One Docker image enriches your DNS logs with verdicts inside your network and forwards them to your SIEM.Install guide

Ownership Changes

Owner/registrant changes: handoffs, churn, suspicious transfers, and takeovers by known attacker groups. Each fires with named evidence and a 3-question analyst Q&A trail.

See 3 Ownership Changes signalsSee verdicts firing these
About

What Ownership Changes captures

Owner/registrant changes: handoffs, churn, suspicious transfers, and takeovers by known attacker groups. Tier-1 SOC analysts use them to cut triage time on suspicious whois behavior; CTI teams pivot from them to the broader campaign graph.

Browse

3 signals in Ownership Changes

Each row opens a leaf page with the signal's direction, named evidence, and 3-question Q&A trail. Use them as audit anchors when a verdict surfaces this subgroup.

Ownership Changes3 signals
Verdict scenarios

How Ownership Changes shapes the call

Three real-world situations where Ownership Changes evidence dominates the decision. Verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A domain that changed hands last month after years under a known organization, and the new owner is tied to an attacker group seen running other campaigns.

VerdictIQ explains

“Decline. The prior reputation belongs to the old owner, and the new one has a track record. Treat it as attacker infrastructure, not an inherited brand.”

Medium riskVERDICT · REVIEW
The situation

A domain that transferred ownership in the last 60 days between two named organizations with unclear relationship.

VerdictIQ explains

“Send to analyst review. The transfer warrants confirmation that the new owner's intent matches prior trust.”

Low riskVERDICT · ALLOW
The situation

A domain held by the same named organization continuously for years with no recent registrant changes.

VerdictIQ explains

“Allow. Ownership continuity is intact. No registrant-change reason to delay.”

See full Verdict Gallery
Sibling subgroups

Other subgroups in WHOIS

2 more subgroups in this group, each bundling signals that share a different mechanism. Tap one to inspect its signal names.

See subgroup detail
See subgroup detail

See Ownership Changes signals fire on your data

Free tier: 1,000 verdicts/month, LLM layer included.

Start FreeBack to WHOIS