It indicates that the domain's WHOIS data — such as ownership, registrar, or contact details — has been updated within a recent time frame. Such updates can sometimes signal ownership transfer, infrastructure change, or reactivation after dormancy.
Three questions every analyst asks before acting on this signal.
It indicates that the domain's WHOIS data — such as ownership, registrar, or contact details — has been updated within a recent time frame. Such updates can sometimes signal ownership transfer, infrastructure change, or reactivation after dormancy.
Frequent or sudden WHOIS modifications are often correlated with suspicious activity, such as domain repurposing or attacker-controlled re-registration. Tracking these updates helps analysts detect early signs of potential abuse.
Updates within the last week or month may suggest active modification or setup of new infrastructure, whereas updates in the past 3–12 months can be normal maintenance by legitimate owners.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "whois_recently_update",
"name": "WHOIS Record Updated in Last Week",
"group": "whois",
"subgroup": "ownership_changes",
"direction": "malicious",
"evidence": {
"owner_changes_12m": 3,
"last_owner_change_days_ago": 14,
"registrant_anonymized": true,
"last_update_days_ago": 14
}
}1 other signal shares the same subgroup. They detect related behaviors and often co-fire on the same IOC.
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.