Why I Stopped Trusting Blacklists and Built a Browser Extension That Checks Domain Age Instead

5 min readFeb 11, 2026

Every day, thousands of phishing sites go live. They look like your bank, your email provider, or your favorite online store. They exist for a few days (sometimes just hours) then vanish, replaced by a new batch. And the cycle repeats. The tools we use to fight them? They’re always one step behind.

The blacklist problem

The standard approach to phishing protection is blacklisting. Someone reports a malicious domain, it gets reviewed, added to a list, and eventually your browser blocks it. Sounds reasonable. But here’s the thing: research shows that the majority of phishing domains are blocked within 4 days of being registered, which sounds fast until you realize that most of them are already done doing damage by then. Some phishing sites live for less than 12 hours. The attacker has already collected hundreds of credentials and moved on to a new domain before anyone even reports the old one. Blacklists are playing whack-a-mole with an opponent that has infinite moles.

A simpler idea

Instead of trying to keep up with every new malicious domain, what if we just asked one question: how old is this domain?

Think about it. When was the last time you visited a legitimate website that was registered 3 days ago? Your bank’s domain is decades old. Google.com was registered in 1997. Amazon, Wikipedia, your company’s website, all old domains. Phishing domains? Almost always brand new. They’re registered, used for a few days, then abandoned. The average phishing domain has a total lifespan of about 21 days. So the heuristic is simple: if a domain is younger than 30 days, it’s suspicious. Not necessarily malicious, but worth a heads-up. That’s exactly what Young Domain Guard does.

How it works (the nerdy part)

When you visit a website, the extension grabs the domain from the URL and queries RDAP : the Registration Data Access Protocol. RDAP is the modern replacement for WHOIS. Unlike WHOIS, which returns messy plaintext that every registrar formats differently, RDAP returns clean, structured JSON over HTTP. Here’s what an RDAP response looks like for example.com:

{
   "ldhName":"example.com",
   "events":[
      {
         "eventAction":"registration",
         "eventDate":"1995–08–14T04:00:00Z"
      },
      {
         "eventAction":"expiration",
         "eventDate":"2025–08–13T04:00:00Z"
      },
      {
         "eventAction":"last changed",
         "eventDate":"2024–05–12T15:13:35Z"
      }
   ],
   "entities":[
      {
         "objectClassName":"entity",
         "roles":[
            "registrant"
         ]
      }
   ]
}

The key field is events. We look for the event with ”eventAction”: “registration”` and grab its eventDate. That’s it, that’s the domain’s birthday. From there, the math is trivial: today — registrationDate = domainAge. If domainAge < threshold, show a warning.

Why RDAP over WHOIS?

WHOIS has been around since the 1980s. It works, but it’s a mess. Every registrar returns data in a slightly different text format, there’s no standard for field names, and parsing it reliably is a nightmare. RDAP fixes all of this, standardized JSON, proper HTTP status codes, and a bootstrap system that routes your query to the right registrar automatically. The query is just a GET request: GET https://rdap.org/domain/example.com, RDAP.org acts as a bootstrap server: it figures out which registrar handles .com domains and redirects you there. No configuration needed.

What happens in the browser

When the extension determines a domain is young, three things happen:

The icon turns red, a glanceable signal that something’s off
A warning banner appears at the top of the page, hard to miss
The popup shows you exactly when the domain was registered and how old it is For domains that pass the check, the icon turns green. For domains where RDAP data isn’t available (some country-code TLDs don’t support it yet), it stays gray. Results are cached for 4 hours, so you’re not hammering RDAP servers every time you open a new tab. And well-known domains like Google, GitHub, and Amazon are skipped entirely, no point checking domains that are obviously fine.

Handling edge cases

A few things that made this trickier than expected:

Multi-level TLDs. You can’t just split a domain by dots and take the last two parts. amazon.co.uk has a two-part TLD (.co.uk), so the registrable domain is amazon.co.uk, not co.uk. Same with .com.au, .org.br, and many others. The extension handles all of these.
RDAP availability. Not all TLDs have RDAP servers yet. Most of the major ones do (.com, .net, .org, .io, etc.), but some country-code TLDs are still WHOIS-only. When RDAP isn’t available, the extension simply doesn’t flag the domain.
Rate limiting. RDAP servers (especially the public bootstrap at rdap.org) have rate limits. Caching results and skipping well-known domains keeps the extension well within those limits for normal browsing.

Is 30 days the right threshold?

Thirty days is the default, but you can change it. The popup has a simple slider where you can set any threshold from 1 to 365 days. Why 30 days as the default? It’s a sweet spot. Research shows that the majority of phishing domains are blocked within their first 4 days, and the average active lifespan of a phishing domain is about 16 days. A 30-day threshold catches almost all of them while keeping false positives manageable. You could set it to 7 days if you want to be less aggressive, or to 90 days if you’re extra cautious. It depends on your browsing habits.

What this is NOT

This isn’t a silver bullet. A young domain doesn’t mean it’s malicious, new legitimate sites launch every day. And an old domain doesn’t mean it’s safe, attackers sometimes use compromised aged domains to bypass exactly this kind of heuristic. But as a lightweight, zero-configuration heads-up? It works surprisingly well. It adds a layer of awareness that didn’t exist before, and it’s fast enough that you won’t even notice it running.

Young Domain Guard is free, open-source, and runs entirely in your browser. There’s no server, no account, no tracking, no ads — nothing leaves your machine. Every RDAP lookup is made directly from your browser to public registrar servers. No middleman, no data collection, no analytics. Just a lightweight extension that does one thing and does it well.

🦊 Firefox: Young Domain Guard on Firefox Add-ons

🌐 Chrome / Brave: Young Domain Guard on Chrome Web Store

📦 Source code: Github IlianAZZ

If you find it useful, a ⭐ on GitHub means a lot. Bug reports and contributions are welcome too.

*I’m Ilian, a software engineer based in Paris. I build things that solve problems I’ve had, this one started when I almost fell for a phishing site that was 2 days old. If you’re into security, automation, or just building stuff, feel free to connect on LinkedIn or check out my other projects on GitHub