It indicates that the domain's WHOIS data, such as ownership, registrar, or contact details, has been updated within a recent time frame. Such updates can sometimes signal ownership transfer, infrastructure change, or reactivation after dormancy.
The questions every analyst asks before acting on this signal.
It indicates that the domain's WHOIS data, such as ownership, registrar, or contact details, has been updated within a recent time frame. Such updates can sometimes signal ownership transfer, infrastructure change, or reactivation after dormancy.
Frequent or sudden WHOIS modifications are often correlated with suspicious activity, such as domain repurposing or attacker-controlled re-registration. Tracking these updates helps analysts detect early signs of potential abuse.
Updates within the last week or month may suggest active modification or setup of new infrastructure, whereas updates in the past 3, 12 months can be normal maintenance by legitimate owners.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "whois_recently_update",
"name": "WHOIS Record Updated in Last Week",
"group": "whois",
"subgroup": "ownership_changes",
"direction": "malicious",
"evidence": {
"owner_changes_12m": 3,
"last_owner_change_days_ago": 14,
"registrant_anonymized": true,
"new_owner_attacker_group_match": true,
"last_update_days_ago": 14
}
}2 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates that the WHOIS ownership or registrant details of a domain have recently changed. Such transitions may occu…
It indicates that the domain has been observed under the control of a known attacker group (its categorization method ma…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
foreskin[.]ccHigh79Verified 2026-08-01eventtracking03[.]comHigh75Verified 2026-08-01eventtracking31[.]comHigh75Verified 2026-08-01allisonineos[.]comHigh77Verified 2026-08-010718kr[.]comHigh78Verified 2026-08-01eventtracking38[.]comHigh75Verified 2026-08-01activity-tracking27[.]comHigh75Verified 2026-08-01activity-tracking20[.]comHigh75Verified 2026-08-01eventtracking18[.]comHigh75Verified 2026-08-01eventtracking28[.]comHigh75Verified 2026-08-01avnportal[.]asiaHigh79Verified 2026-08-01crytwaultattx[.]comHigh80Verified 2026-08-01cloudservicecon[.]comHigh85Verified 2026-08-01eventtracking17[.]comHigh75Verified 2026-08-01activity-tracking16[.]comHigh75Verified 2026-08-01eventtracking19[.]comHigh75Verified 2026-08-0107207[.]winHigh79Verified 2026-08-01eventtracking40[.]comHigh75Verified 2026-08-01avnsgserver[.]asiaHigh83Verified 2026-08-01autosloading[.]comHigh86Verified 2026-08-011,000 verdicts/month on the free tier, LLM layer included. No card required.