Short answer
An NRD detection pipeline ingests the daily list of newly registered domains with full whois records, scores each domain on registrar, nameserver, country and lexical similarity to protected brands, then pushes high-risk domains to DNS filters and secure web gateways while retaining the full set in the SIEM for retrospective hunting.
Key takeaways
- Domain age under 30 days is one of the highest-signal, lowest-cost risk indicators available.
- Whois fields turn isolated domains into clustered campaigns via shared registrant pivots.
- Score and tier rather than blanket-block, or you will drown the help desk in false positives.
- Retain 30+ days of history so you can hunt backwards after an incident is discovered.
- Lexical similarity scanning against your own brand catches phishing before it resolves.
Attackers register fresh domains for the same reason marketers avoid them: they carry no reputation. A domain registered this morning has no history to hold against it, which is exactly what makes reputation-based filtering blind to it — and exactly why domain age has become one of the most reliable single features in phishing detection. This article covers how to turn a daily NRD feed into an operational control rather than a dashboard.
Why domain age is such a strong signal
Malicious infrastructure is disposable by design. A phishing kit runs for hours to days before it is reported and taken down, so the operator registers cheaply, uses the domain fast, and abandons it. The result is a heavy skew: a very large share of confirmed phishing and malware C2 domains are under 30 days old at time of use, while legitimate business domains are overwhelmingly older. That asymmetry is what the control exploits.
Blanket blocking is a blunt instrument
Every legitimate new business also has a domain under 30 days old. Blanket-blocking all NRDs generates constant false positives against genuine partners and suppliers. Tier the response: block the high-risk band, sandbox or warn on the middle, log the rest.
A practical risk-scoring model
| Feature | Source field | Signal |
|---|---|---|
| Age | createdDate | Under 7 days is materially riskier than 7-30 |
| Lexical similarity | domainName | Levenshtein or homoglyph match against protected brands |
| Registrar | registrarName | Abuse rates vary enormously between registrars |
| Nameserver | nameServers | Bulletproof and known-abused NS ranges |
| Registrant reuse | registrant_email, registrant_telephone | The same contact across many same-day domains is a campaign |
| Geo mismatch | registrant_country | Registrant country inconsistent with the brand being imitated |
| Keyword | domainName | login, secure, verify, wallet, invoice, support, update |
Weight these into a single score, tier the output into block / sandbox / monitor, and tune the thresholds against your own confirmed incidents for a few weeks. A model tuned on your traffic beats a generic vendor score in almost every environment.
Whois pivoting: from one domain to the whole campaign
This is where a whois-enriched NRD feed decisively outperforms a bare list of domain names. When an incident surfaces a single malicious domain, the whois record gives you pivot keys — registrant email, telephone, organisation string, postal address, nameserver set and registrar. Querying those keys back across your retained history routinely turns one indicator into dozens of related registrations, many of which have not been used yet.
- 1Incident surfaces one confirmed phishing domain.
- 2Extract registrant_email, registrant_telephone and nameServers from its whois record.
- 3Query the retained NRD history for every domain sharing any of those values.
- 4Cluster the results and check registration timestamps for burst patterns.
- 5Pre-emptively block the entire cluster, including domains not yet weaponised.
- 6Feed the cluster's shared attributes back into the scoring model as high-weight features.
Typosquat and brand-impersonation scanning
Run each day's list through a similarity scan against your organisation's brand strings and their common mutations: character omission and duplication, adjacent-key substitution, homoglyphs across scripts, hyphen insertion, and the same string under different TLDs and gTLDs. Because you are scanning at registration rather than waiting for the domain to resolve, you typically see the impersonation days before any content appears — and takedowns filed at that stage are faster and cheaper.
Where the feed plugs in
- DNS filter / protective DNS — push the high-risk tier as a blocklist, refreshed daily.
- Secure web gateway — sandbox or interstitial-warn the middle tier rather than hard-blocking it.
- SIEM — ingest the whole day so NRD status becomes a queryable attribute on every DNS and proxy log line.
- SOAR — auto-enrich alerts with domain age and registrant detail before an analyst ever sees them.
- Email security — flag messages containing links to domains registered in the last seven days.
- Threat-intel platform — store the whois record as the pivot substrate for cluster analysis.
Why history matters more than you expect
Incidents are usually discovered well after the fact. If your feed only ever gave you today's file, you cannot answer the question that always gets asked in the post-incident review: when did this domain appear, and what else appeared alongside it? Retaining 30 days or more of full whois records on the server — and archiving them yourself beyond that — is what makes retrospective hunting possible.
GetWhoisData delivers the daily newly-registered-domain database with complete whois records over FTP, with 30 days of history available on the server and unlimited downloads, which makes both the daily control and the retrospective hunt straightforward to automate.
Frequently asked questions
Should I block all newly registered domains?+
Not outright. Blanket blocking generates false positives against legitimate new businesses. Tier the response: block a high-risk scored band, sandbox or warn on the middle band, and log everything else so it remains queryable.
What counts as a newly registered domain in security terms?+
Most security tooling treats a domain as newly registered for 30 days after its creation date, with the first 7 days considered the highest-risk window.
How does whois data improve phishing detection?+
Whois fields supply pivot keys — registrant email, phone, organisation and nameservers — that let you cluster many related domains from a single confirmed indicator, including ones not yet used in an attack.
How do I detect typosquats of my brand?+
Run each day's newly registered domain list through lexical similarity scanning against your brand strings, covering character substitution, omission, duplication, homoglyphs, hyphenation and alternate TLDs.
How much NRD history should I retain?+
At least 30 days on hand for retrospective hunting after incident discovery, and ideally your own longer-term archive of the daily files for campaign attribution over months.