Why Blocking Newly Registered Domains Stops Phishing
By [FILL IN], [FILL IN] · Last updated
Most phishing sites live only hours or days. Blocking young domains using registration data cuts off scams before threat lists catch up.
Phishing domains are short-lived
Scammers register a domain, send a wave of messages and abandon it once it lands on a blocklist. The most dangerous window is the first hours and days, exactly when traditional lists know nothing about the domain.
How age-based blocking works
The registration date of a domain is public through RDAP, the modern replacement for WHOIS. A DNS firewall looks up the creation date and blocks domains younger than a chosen number of days.
Choosing a threshold
Thresholds are a trade-off between protection and the occasional false positive.
- 7 days: low impact, catches the fastest campaigns
- 30 days: a strong default for homes and small offices
- 90 days: strict, suitable for high-risk environments
Handling false positives
A new store or a friend's fresh project might be blocked. Add it to your allowlist once and it works for every device on your network.