A newly registered domain is one created very recently, often within the last 30 days; phishing campaigns rely heavily on such fresh, short-lived domains.
A newly registered domain (NRD) is a domain name that was registered recently. There is no single official cut-off, but security feeds commonly treat domains younger than about 30 days as newly registered. Because attackers tend to register domains shortly before a campaign and abandon them soon after, domain age is one of the most useful signals in phishing detection.
How it works
Registries publish zone data, and services collect new domain names from zone files, registration data (RDAP) and certificate transparency logs. The resulting NRD feeds are used in several ways:
- brands filter them for names resembling their own, such as typosquatting and combinations with words like "login" or "support";
- email gateways and secure web gateways treat links to very young domains as higher risk;
- some organisations block or warn on all NRDs for a period, as a type of domain blocklist.
Not every new domain is malicious, of course. Most belong to new businesses and projects, so NRD data is a starting point for review rather than proof.
Example
As an illustration, a daily NRD feed shows that examplebank-support[.]com, examplebank-verify[.]net and examp1ebank[.]com were all registered on the same day through the same registrar, with the same name servers. None has content yet. The pattern suggests a coordinated campaign, so the brand adds them to a watch list and prepares evidence.
How to spot it
- A creation date within the last few days or weeks in RDAP or WHOIS data.
- Several similar names registered together with shared name servers or hosting.
- Privacy-protected registration combined with brand terms in the name.
- A fresh TLS certificate issued right after registration.
- Mail (MX) records configured on a domain that has no website yet.
What brands can do
Monitor NRD feeds for your brand names and common variations, and prioritise matches that also have DNS, mail or certificate activity. Keep watching suspicious domains, because many stay dormant until the campaign starts. Once a domain carries phishing content, report it promptly; if it only infringes your trademark, consider UDRP. Phishvoid monitors new registrations as part of its detection; contact us to add your brand.
Read more: Typosquatting and Homoglyph Domains Explained
Seeing this against your brand?
We find and take down phishing and impersonation sites. Tell us what you are seeing.