Domain Age and Reputation: A Quiet but Powerful Fraud Signal

Fraud infrastructure is disposable by design, and that includes domains. Abusers register fresh domains in bulk, use them for a burst of fake signups or phishing, and move on before reputation systems catch up. That churn is exactly why domain age and reputation are such reliable, and underused, fraud signals.

Why young domains are risky

A domain registered twelve days ago has no track record. It hasn't sent legitimate mail, hasn't accrued reputation, and often lacks the infrastructure a real business maintains. Legitimate customers overwhelmingly use established providers or company domains that are years old; fraud clusters on domains that are days or weeks old.

• `domain_age_days`: days since registration. Very low values are a strong risk contributor.
• `registrar` & `registration_date`: WHOIS data that helps distinguish throwaway domains from established ones.
• `has_website` / `has_mailserver`: real businesses usually have both; disposable domains often have neither or only MX.

Reputation beyond age

Age is the headline, but reputation is broader: does the domain resolve to real infrastructure, does it have a website, is the provider known for abuse? RiskUnified rolls these into a single domain_risk level (low / medium / high) so you don't have to interpret raw WHOIS yourself.

{
  "domain_features": {
    "domain": "gmail.com",
    "domain_risk": "low",
    "domain_age_days": 11299,
    "has_website": true,
    "has_mailserver": true
  }
}

Using it in your risk model

Domain age works best as a weighted input, not a standalone gate, some legitimate startups do sign up from brand-new domains. Combine a low domain_age_days with an undeliverable mailbox or a catch-all configuration and you have a high-confidence fraud pattern worth blocking or reviewing.