Do Criminals “age” Domains?
It’s widely understood that criminals most often acquire domains through direct registration, use them shortly after acquisition, and repeat this process when they begin their next campaign(s). We call these malicious domain registrations.
It’s also been observed that some criminals acquired domain names months, even years before they were used in a campaign – through domain hijacking, by registering neglected domains, or registering and storing domains before using them – reasoning that old domains might evade detection systems that used domain age as a trust indicator.
Today, we’ll look at data that we recently ingested at our Cybercrime Information Center to understand which of these conventional wisdoms hold water.
