Are New Domains More Dangerous Than Aged Ones?

Not necessarily, and the assumption that they are is what attackers exploit.

Newly registered domains carry obvious risk and most security teams already block them. Palo Alto Networks defines a newly registered domain as one registered or transferred within the last 32 days, and Unit 42's analysis of 1,530 top-level domains found more than 70% were malicious, suspicious, or not safe for work.

The number that matters more is the one nobody blocks on. In Unit 42's study of strategically aged domains, 3.8% showed malicious behaviour, which the researchers state is more than three times higher than the 1.27% rate among newly registered domains. Domains that have sat quietly for years are more dangerous than domains registered last week, precisely because age reads as trust.

This chapter covers how attackers use both ends of the age range, what each signal is actually worth, and where domain age stops being useful on its own.

Why Newly Registered Domains Are Blocked

What Makes a New Domain Risky

A newly registered domain is one registered, or transferred to a new owner, within roughly the last month. Palo Alto Networks uses 32 days as the cutoff, based on its finding that this is the window in which new domains are most likely to be detected as malicious. We use 30 days window for NRDs.

The risk is concentrated because registration is cheap and disposable. Attackers register in bulk, use a domain for hours or days, and abandon it before most detection systems catch up. Common uses:

• Phishing attacks.
• Malware distribution.
• Domain squatting, typosquatting.

Why Speed Matters More Than Accuracy Here

Most malicious new domains are short-lived, which inverts the usual detection trade-off. A system that flags a domain accurately three days after registration has already missed the campaign.

That is why we recommends blocking the entire newly registered category for 30 days rather than attempting to sort good from bad within it. The false positives are real: a customer launching a genuinely new product will be blocked. The recommendation stands anyway, because the base rate is so unfavourable that per-domain judgment costs more than it saves.

If blanket blocking is too aggressive for your environment, the fallback is to alert rather than block, which preserves visibility without breaking legitimate access.

Screening a New Domain Feed

To protect against potential threats from WhoisFreaks' Newly Registered Domains, you can take the following steps to analyze a domain like 'amazon.com':

• Download Newly Registered or Expired domains file.
• Filter all domain names containing the keyword amazon. Just for your information, there are 57 Generic Top-Level Domains (gTLDs) and 10 Country Code Top-Level Domains (ccTLDs) newly registered on 2024-03-11 containing amazon.
• Filter the list based on potential typosquatting domains, which are those that are similar to the targeted domains.
• Analyze each of these domains individually using a live Whois lookup to retrieve current details. Additionally, we'll conduct historical lookups to gather past records and analyze previous ownerships for further insight.
• Once this analysis is complete, we will have domains with red flags indicating potential risks. At this stage, we can consider taking the following measures:
  • Implement domain blocking or filtering at your network's perimeter defenses, such as firewalls, DNS filters, or web gateways.
  • Configure your security systems to alert administrators when attempts are made to access these domains.
  • Educate your employees about the risks associated with malicious domains.

Why Aged and Expired Domains Are the Harder Problem

An expired domain hands an attacker something a new registration cannot buy: history. Search engines, reputation systems, and email filters all treat age as a proxy for legitimacy, and a domain that has existed for a decade inherits that assumption regardless of who controls it now.

The same logic drives a related and more serious pattern. Rather than buying an expired domain, an attacker registers one and simply waits. Unit 42 documented that the command-and-control domain behind the SolarWinds compromise was registered in 2018 and sat dormant for two years before its traffic increased roughly 165 times as the campaign activated. Its detection system captured around 26,000 such domains per day, and they show a characteristic signature: long dormancy followed by a traffic jump averaging more than ten times in a single day.

What Makes an Aged Domain Risky

Expired domains can lead to vulnerabilities such as

• If the expired domain was previously associated with a legitimate business or organization, attackers could recreate a similar website or email service to impersonate the original entity.
• By taking over an expired domain, attackers can potentially access email accounts associated with that domain if they manage to configure the domain's mail exchange (MX) records
• An expired domain with a good SEO history can be repurposed for phishing while still attracting traffic through search engines.

Defending Against Aged Domain Abuse

To mitigate the threats posed by expired domains, organizations should implement a comprehensive domain management strategy. This includes;

• Regularly auditing and tracking domain registrations to ensure key domains are renewed on time.
• Employing domain monitoring services to keep an eye on the status of all company domains and using security tools to detect and block malicious activities associated with expired domains. One such tool called Domain Monitoring is created to avoid such situations.

How Much Weight to Give Domain Age

Age is one signal among several, and its meaning changes across the range. This table summarises what each band actually tells you, based on the Unit 42 malicious rates cited above.

The row that matters are the second one. It is the only band where age alone actively misleads you, and it is where the most capable attackers operate.

Recently expired and re-registered. The distinction between expired and fully dropped matters here, and is covered in dropped vs expired domains

Where Domain Age Stops Being Useful

Three limits are worth stating plainly, because a screening programme built on age alone will miss things in predictable ways.

• Age says nothing about compromise. A fifteen-year-old domain belonging to a legitimate business can be taken over and used to send phishing from an address recipients already trust. No age signal catches this. Only behavioral change does.
• Registration dates are inconsistent across TLDs. We derive registration dates from zone files where available, falls back to passive DNS for country-code TLDs that do not publish them, and reconciles against WHOIS records. A domain's apparent age depends on which source you consulted.
• Blanket blocking has a real cost. Blocking every domain under 30 days will block legitimate product launches, rebrands, and campaign microsites. The recommendation holds because the base rate justifies it but treat the false positives as a known cost to manage rather than a flaw to be surprised by.

For the raw feeds behind this work, see newly registered domains and the expired domains database. For a fuller treatment of accessing and using NRD data, see how to access and use newly registered domains.