It indicates that the WHOIS ownership or registrant details of a domain have recently changed. Such transitions may occur legitimately (brand migration or registrar updates) or maliciously (expired-domain reuse, reputation hijacking, or stealth acquisition).
Three questions every analyst asks before acting on this signal.
It indicates that the WHOIS ownership or registrant details of a domain have recently changed. Such transitions may occur legitimately (brand migration or registrar updates) or maliciously (expired-domain reuse, reputation hijacking, or stealth acquisition).
Because attackers often acquire previously legitimate or dormant domains and repurpose them for malicious use, benefiting from their prior reputation. A sudden WHOIS ownership transition without consistent DNS, SSL, or content history continuity is considered suspicious.
Analysts should correlate WHOIS transitions with infrastructure changes such as new name servers, SSL re-issuance, or IP migrations. Unexpected transitions, especially in high-value or previously trusted domains, should be flagged for deeper investigation.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "whois_owner_changed",
"name": "Domain Ownership Transition in Last Month",
"group": "whois",
"subgroup": "ownership_changes",
"direction": "malicious",
"evidence": {
"owner_changes_12m": 3,
"last_owner_change_days_ago": 14,
"registrant_anonymized": true,
"last_update_days_ago": 14
}
}1 other signal shares the same subgroup. They detect related behaviors and often co-fire on the same IOC.
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.