The fix, in one snippet
whois example.com | grep -i 'creation date'Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The checker finds the registrable domain, locates the registry's RDAP server through the IANA bootstrap file, and reads the registration event from the RDAP response (RFC 9083), along with the last-changed date and registrar. Registration within thirty days is medium, within seven days high, and within a year is noted as information. Where a registry offers no RDAP service, or redacts the dates, the result is "unknown" rather than a guess. When available, the age of the site's TLS certificate from certificate transparency is shown as a second signal. Limits: RDAP is rate-limited and incomplete for some country-code TLDs; an old domain can be compromised and used to host a phishing kit, so age is not proof of legitimacy; a domain that lapsed and was re-registered shows the new date.
Why it matters
Phishing domains are burned quickly and block lists lag by hours to days, so a domain registered this week that presents a Microsoft or bank sign-in page is close to certain phishing. Business email compromise follows the same pattern: the lookalike of a supplier's domain is registered days before the "new bank details" email. New legitimate businesses exist, which is why the finding is combined with the others rather than treated alone.
How to fix it
Do not sign in on a days-old domain, and treat any claim to be an established brand from such a domain as decisive. You can check registration dates yourself with any RDAP client:
$ curl -s https://rdap.org/domain/example.com | jq '.events'Businesses: pre-register obvious variants of your domain, monitor new registrations and certificate transparency for your name, and enforce DMARC so lookalikes cannot also spoof your real domain. Related: lookalike domains and abused TLDs. Guides: how to spot phishing and SPF, DKIM and DMARC.
Where this fits
Domain registered very recently is check 6 of 13 that the phishing url checker runs under url and phishing indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Lookalike of a well-known brand domain (high), where the registered domain closely resembles a well-known brand's domain through a typo, an inserted character, a swapped letter or a plausible variant, but is not it. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Domain registered very recently closes one route in. Immediately below it: Link uses plain HTTP, where the link uses plain http://, so anything you send to the page, including a password, would travel unencrypted, and the page itself could be altered on the way; Long or cross-domain redirect chain, where following the link produced several redirects, or a redirect onto a different domain, so where you land is not where the link appears to go; Page asks for credentials, where the page at the link asks for a username and password, so if anything else about the URL is off, this is where the credentials would be harvested.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Domain registered very recently (medium severity)
Scanner check id: url-new-domainThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 13, 2026
How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work
Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...
Read the guide
9 min read · Updated Sep 10, 2026
SPF, DKIM and DMARC Explained: Stopping Email Spoofing of Your Domain
Without SPF, DKIM and DMARC anyone can send email that appears to come from your domain. What each record does, how to write them, how...
Read the guide