30-Day Domain Strategy: Scammer Lookalike Brands

The 30-Day Domain Strategy: How Scammers Register Lookalike BrandsFresh domains raise fewer flags in reputation systems, but registrars hand them out in seconds. Understanding the tactics scammers use — and the RDAP trails they leave — changes how you evaluate a suspicious link.Why 30 Days?The 30-day window is a practical constraint, not an aesthetic choice. Most reputation scoring systems — web proxies, email security gateways, browser safe-browsing lists — give a domain some benefit of the doubt for the first few weeks of its life. A domain registered yesterday with no traffic history has no reputation, negative or positive. Abuse scoring systems often treat "unknown" more leniently than "bad."Attackers respond rationally to incentives. They register domains well in advance, let them sit quietly (called "parking"), build minimal legitimate-looking content, and only activate the phishing infrastructure after the domain has aged past the hair-trigger detection window. Waiting 30 days typically means cleaner delivery, fewer CAPTCHA challenges, and lower spam scoring.Some sophisticated operators run "pre-warming" periods where the parked domain serves innocuous redirects or static content pages to generate real user traffic and click-through signals — making the domain look lived-in before it's weaponised.The Typosquatting PlaybookGenerating lookalike domains is a solved problem. Tools that automate permutation generation are freely available. For any target domain, the attack surface includes:Character substitution: Replacing visually similar characters. rn → m, l → 1, 0 → o. paypaI.com (capital I) is indistinguishable from paypal.com in many serif fonts. Punycode makes this worse — xn--pypa-rnb.com renders as a Cyrillic version of "paypa" that looks identical in some browsers.Insertion: Adding a word around the brand. barclays-secure.com, natwest-account-verify.co.uk, amazon-prime-renewal.com. Users often read these as subdomains of the legitimate brand.TLD swap: The same SLD on a different TLD. amazon.co, gov.uk-refund.org, hmrc.info.Combosquatting: Appending a service-related word. appleidsupport.com, netflixbillingerror.com, lloydsbankonline.com.What RDAP Tells YouThe Registration Data Access Protocol replaced WHOIS for most major registrars. It returns structured JSON rather than free-text output and provides the key fields you need to assess domain risk:

Registration date: When the domain was first registered.

Expiry date: When it's scheduled to expire. Scam domains are often registered for the minimum period (1 year) on cheap promotional offers.

Registrar: Some registrars are significantly more permissive about abuse reports than others. Domains registered through registrars with poor abuse response histories are higher risk.

Status flags: clientHold means the domain has been suspended — clear signal of prior abuse. pendingDelete means it's about to be released back to the pool.

Name servers: Freshly registered domains often use default registrar nameservers initially, then switch to a CDN or bulletproof hosting provider shortly before the campaign.

The Quiet Parking PhaseA parked domain serving a "coming soon" page or a default registrar placeholder looks very different to a reputation system than a domain with no DNS records at all. Sophisticated operators:

Point it at a clean, purpose-built holding page that passes manual review if any analyst looks.

Set up a functional MX record — even if no mail is sent, the presence of an MX record makes the domain look like a real business operation.

After the parking phase ends, swap the A record to phishing infrastructure, often through a CDN that provides an additional layer of IP reputation laundering.

The switch is fast — A record TTLs can be set to 60 seconds. By the time abuse reports propagate and blocklists update, the campaign may already be over.Reading Registration Age as a Risk SignalDomain age is a single signal, not a verdict. A 3-day-old domain is not automatically malicious, and a 10-year-old domain is not automatically safe (account takeover is real). But in context:

Brand impersonation domain + registered in last 30 days: High risk.

Financial service reference + registered in last 7 days: Very high risk.

Registrar in a high-abuse jurisdiction + registered yesterday + MX present: Treat as malicious until proven otherwise.

The combination of registration age, registrar identity, status flags, and the specific string of the domain gives you enough context to make a fast, confident call on most suspicious links.

Check a domain's age

More Scamlify cybersecurity research

Security suite