Domain Age as a Risk Indicator: Why "New" Often Means "Danger"
Newly registered domains (NRDs) are a favorite tool for threat actors. Learn why domain age is a critical signal in your threat intelligence stack and how to use it effectively.
Jean-Vincent QUILICHINI
If you walked into a bank that opened yesterday, would you deposit your life savings? Probably not. You trust institutions with a history. The same logic applies to the internet, yet many security systems treat a domain registered 5 minutes ago with the same trust as one registered 15 years ago.
Domain age is a useful but underused signal in threat intelligence. Here’s why threat actors favor newly registered domains and how analysts can evaluate them.
The "Burner" Domain Strategy
Cybercriminals operate on a churn-and-burn model. They register thousands of domains for:
- Phishing campaigns: Mimicking legitimate brands (e.g.,
support-google-auth-update.com). - Command & Control (C2): Hosting malware callbacks.
- Spam: Sending millions of emails before the domain gets blacklisted.
Once a domain is flagged, they discard it and move to the next one. This means that a domain that is less than 30 days old has a statistically higher probability of being malicious than an established one.
The "Baby Domain" Policy
Many mature security organizations implement a Newly Registered Domain (NRD) policy. This involves:
- Blocking: Automatically blocking access to any domain registered in the last 24-72 hours.
- Flagging: Treating traffic to domains < 30 days old as "suspicious" and subjecting it to deeper inspection.
- Quarantine: routing emails from NRDs to a sandbox or spam folder automatically.
False Positives vs. Risk Reduction
Critics argue that blocking new domains hurts legitimate businesses launching new products. While true, the ratio of malicious to legitimate NRDs is overwhelmingly skewed towards malice.
The solution is context. Don't just block based on age. Combine age with:
- Entropy: Is the domain name random characters?
- Registrar: Is it a cheap/free registrar often used by spammers?
- Hosting: Is it hosted on a bulletproof hosting provider?
How isMalicious Helps
isMalicious enriches domain data with registration dates and reputation scores. This allows you to build granular policies. For example: "Block if Age < 7 days AND Threat Score > 50."
Conclusion
In the race against cyber threats, time is a critical dimension. By factoring domain age into your security logic, you cut off a massive avenue of attack before it even begins. Treat new domains with skepticism until they earn their trust.
Related articles
Aug 21, 2026Firewall Blocklist Automation: Pulling IP and Domain Feeds Without OutagesExternal dynamic lists can block malware and phishing at the edge — or break payroll, CDN traffic, and vendor portals. This guide covers staged rollout, allowlists, fail-open vs fail-closed, and measuring hit rates for IP and domain blocklists.
Aug 12, 2026isMalicious vs Cisco Talos: Reputation Lookups Outside the Cisco StackTalos reputation is excellent and it lives inside Cisco products. If your stack is not Cisco, or you need an API rather than a web form, that is where the comparison starts.
Aug 11, 2026Bulk IP and Domain Lookups: Designing Indicator Enrichment That Survives Real VolumeOne incident produces hundreds of indicators, and per-indicator lookups are where triage stalls. Here is how to build a batch enrichment pipeline that respects quotas, deduplicates properly, and fails gracefully.
Protect Your Infrastructure
Check any IP or domain against our threat intelligence database with indexed records.
Try the IP / Domain Checker