It indicates that the domain has been registered through a reputable and security-compliant registrar. Such registrars typically enforce identity verification, monitor for abuse, and cooperate with law enforcement or security vendors to prevent misuse.
Three questions every analyst asks before acting on this signal.
It indicates that the domain has been registered through a reputable and security-compliant registrar. Such registrars typically enforce identity verification, monitor for abuse, and cooperate with law enforcement or security vendors to prevent misuse.
Malicious domains are often registered via low-cost or poorly regulated registrars that lack abuse handling processes. Domains obtained from trusted registrars are statistically less likely to be associated with phishing, malware distribution, or C2 activities.
Trusted registrar information helps analysts distinguish between likely safe and suspicious registrations. When combined with other WHOIS and DNS attributes, it contributes to contextual risk scoring and reduces false positives in automated systems.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "whois_trusted_registrar",
"name": "Trusted Registrar (WHOIS-Based)",
"group": "whois",
"subgroup": "registrar_trust",
"direction": "safe",
"evidence": {
"registrar": "Namecheap",
"registrar_trust_tier": "tier_2",
"abuse_history_count": 0,
"iana_id": 1068
}
}The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
100 IOCs/day on the free tier, LLM layer included. No card required.