Phishing sites live fast. They’re registered, used for a few days and abandoned before the blocklists catch up. That’s why domain age is one of the signals in a ThreatDNS report.
How we use it: a domain registered under 30 days ago adds to the risk score. On its own it won’t make something Malicious; it matters most when something else is off too, like a few VirusTotal detections or a lookalike name.
When new is fine: a business that just launched, a marketing campaign site, a renamed product. Plenty of legitimate domains are a week old.
What to check alongside it:
- Does the name imitate a brand you know?
- Did it arrive in an urgent email or text?
- Is it asking you to sign in or pay?
Three yeses plus a brand-new domain is about as clear as it gets. The registration date and registrar are in every report: https://threatdns.com/?utm_source=reddit&utm_medium=community&utm_campaign=domain-age
Source: r/threatdns · by /u/dnsafe