How to check a domain's age, and why it matters
A domain's age is the cheapest useful signal in phishing triage. It will not tell you a site is malicious, but it will tell you which handful of names out of hundreds deserve a human minute.
Where the date comes from
Every domain ending is run by a registry, and registries publish a creation date for the names under them. Modern registries answer over RDAP, a structured JSON protocol; older ones still answer the text-based WHOIS. Either way the date is the registry's own record, not an estimate and not something a site can change.
One thing that catches people out: this is the date the current registration began, not the date the current owner acquired the name. A twenty-year-old domain that changed hands last month still shows its original date and looks old, because the registration never lapsed. That is why age is a filter rather than a verdict.
Why new domains and phishing go together
A phishing domain has a short working life. It goes up, it collects credentials for a few days, it gets reported, and browsers and mail filters start blocking it. The economics push attackers to register continuously and cheaply, so a campaign can burn through domains rather than defend one. That economics is why a recent registration date is worth reading first, and it is a reason to look rather than a measurement of how common anything is.
One year is the threshold this tool uses to decide which rows to flag and sort to the top. It is a prioritisation heuristic, not an industry standard and not a verdict: it decides reading order, nothing more. Below it, a domain impersonating a brand is worth a look first. Above it, a lookalike is more often a squatter sitting on a name, a parked ad page, or a business that genuinely shares part of your name.
It cuts both ways, and an analyst has to hold both. Plenty of legitimate businesses register a domain this week, so new does not mean hostile. And an established domain can be bought, or simply compromised, so old does not mean safe. Age narrows the list you read first; it does not decide anything.
Reading the number
- Days old. Read this one first, especially if it is live and mentions a brand. That combination is worth opening the screenshot for before you do anything else.
- Weeks to months. Where most of a short-lived campaign's life happens, and also where a lot of ordinary new businesses sit.
- Under a year. Worth a look.
- Several years. Usually a squatter or an unrelated business. Still worth checking if it is actively impersonating.
What the date does not tell you
The creation date describes the current registration, not the name. A domain that lapsed and was picked up by someone else shows the date of that later registration, so a name that has existed for fifteen years can read as weeks old, which is accurate and is exactly what you want to know. The reverse also holds: an attacker who buys an aged domain from a reseller inherits its old date, and the number will look reassuring when it should not. Registries record when the registration began, and nothing about who holds it or what it is for.
Domains with no date at all
Some country registries publish nothing. Ask for a date on certain national domains and the honest answer is that there isn't one available. The domain exists and may be serving a live site, but its registry does not disclose when it was created.
That is a real answer, not a failure, and it should not be quietly turned into a guess. Where a date cannot be established, a domain is better marked as undatable and judged on whether it resolves, whether it is serving content, and what that content says.
Checking many at once
Checking one domain is easy anywhere. The useful version is checking a list: every variation of your brand, every domain in a suspicious email header, every host that appeared in a log. Sorting that list by age puts the interesting ones at the top and lets you ignore the rest.
Age on its own still is not enough to act. A new domain serving nothing may be parked, may be staged for later, or may exist only to send mail, so quiet is not the same as harmless. A new domain that is live, accepts mail, and puts your brand name in its page title is the strongest combination this tool can show you, and it is where to spend your attention first. It is still a set of signals rather than a finding. The screenshot is the next piece of evidence to weigh, not a verdict: seeing your own login page reproduced is a great deal more telling than seeing a parking page, and either way a human decides.
Questions
Where does a domain's registration date come from?
From the registry that runs the domain's ending, published through RDAP or the older WHOIS. It is the date the current registration began. A domain that changed hands without lapsing keeps its original date, while one that expired and was registered again shows the later date.
Why do phishing sites use new domains?
A phishing domain has a short working life: once it is reported it gets blocked, so operators register fresh ones continuously rather than reusing one. Domains are cheap and disposable, which is why a recent registration date is worth reading first. It is a reason to look, not a finding.
Why does a domain show no registration date?
Some country registries publish no dates at all. The domain is registered and may be live, but the date is genuinely unavailable rather than missing.
Check a domain's age →Paste up to 50 domains and see when each was registered. Free, no account.