Registration date is the first thing everyone reaches for, and it is a weaker signal than it appears — because attackers know it is the first thing everyone reaches for.
Reading it
$ curl -s https://rdap.verisign.com/com/v1/domain/example.com | jq -r '.events[]'
{ "eventAction": "registration", "eventDate": "..." }
{ "eventAction": "expiration", "eventDate": "..." }
{ "eventAction": "last changed", "eventDate": "..." }last changed is the underused one. A domain registered in 2019 and modified yesterday is a different proposition from one registered in 2019 and untouched — the first may have been bought, transferred or repurposed.
What age is worth
| Observation | Weight |
|---|---|
| Registered in the last 30 days | Meaningful. Most phishing domains are young, and most young domains are not phishing. |
| Registered years ago, never used, now resolving | Strong. Aged deliberately, or bought from an expiry market. |
| Registered years ago, continuously used | Weak signal of abuse. Look at what it actually serves. |
| Recently transferred or modified | Meaningful, and routinely ignored. |
Deliberate aging
- Attackers register in advance and leave the domain dormant precisely so age-based scoring clears it later.
- Expired domains are bought for their history. An eight-year-old domain with prior legitimate use passes age checks and reputation checks together.
- So age alone should never clear a domain. It can raise a score and it must not lower one to the point of dismissal.
The asymmetry to remember
Newly registered is worth escalating on. Not newly registered is worth nothing — it excludes the laziest attackers and no one else. Treat age as a reason to look harder, never as a reason to stop looking.