It indicates that the WHOIS ownership or registrant details of a domain have recently changed. Such transitions may occur legitimately (brand migration or registrar updates) or maliciously (expired-domain reuse, reputation hijacking, or stealth acquisition).
The questions every analyst asks before acting on this signal.
It indicates that the WHOIS ownership or registrant details of a domain have recently changed. Such transitions may occur legitimately (brand migration or registrar updates) or maliciously (expired-domain reuse, reputation hijacking, or stealth acquisition).
Because attackers often acquire previously legitimate or dormant domains and repurpose them for malicious use, benefiting from their prior reputation. A sudden WHOIS ownership transition without consistent DNS, SSL, or content history continuity is considered suspicious.
Analysts should correlate WHOIS transitions with infrastructure changes such as new name servers, SSL re-issuance, or IP migrations. Unexpected transitions, especially in high-value or previously trusted domains, should be flagged for deeper investigation.
'Domain Ownership Transition' covers WHOIS-sourced ownership changes only: it reports that the registrant details changed, not who the new operator is. 'Attacker Group Takeover' is a separate signal derived from attacker-group attribution, where the new operator is a known malicious actor. A domain can carry both signals at once.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "whois_owner_changed",
"name": "Domain Ownership Transition in Last Month",
"group": "whois",
"subgroup": "ownership_changes",
"direction": "malicious",
"evidence": {
"owner_changes_12m": 3,
"last_owner_change_days_ago": 14,
"registrant_anonymized": true,
"new_owner_attacker_group_match": true,
"last_update_days_ago": 14
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the domain has been observed under the control of a known attacker group (its categorization method ma…
It indicates that the domain's WHOIS data, such as ownership, registrar, or contact details, has been updated within a r…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
0717bus[.]comHigh78Verified 2026-08-01bbpayqianbao[.]comHigh82Verified 2026-08-01bbowl[.]xyzSuspicious62Verified 2026-08-01dp005[.]comSuspicious60Verified 2026-08-01encas[.]orgHigh77Verified 2026-08-01bigolov[.]comSuspicious67Verified 2026-08-01api1-meta[.]comSuspicious66Verified 2026-08-01dropped[.]topHigh78Verified 2026-08-01epaaab[.]comSuspicious68Verified 2026-08-01avmfinserv[.]comHigh78Verified 2026-08-01bbpayzhuce[.]comHigh82Verified 2026-08-0178dv[.]comSuspicious67Verified 2026-08-01cfbqjs[.]comSuspicious65Verified 2026-08-01acm-usa[.]comSuspicious72Verified 2026-08-01dogem[.]netHigh79Verified 2026-08-01cs-dada[.]comSuspicious73Verified 2026-08-01bbpaykefu[.]comHigh82Verified 2026-08-01bbpayguanwang[.]comHigh82Verified 2026-08-01eorthopaedics[.]comSuspicious65Verified 2026-08-01blockchain-newtech[.]comSuspicious69Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.