Newly Registered Domains: Why Blocking Them Stops Phishing

Newly registered domains are website names registered in the last few days. The vast majority are harmless: new businesses, side projects, campaign pages. But they're also the raw material of phishing and scams. A fresh domain has no reputation, isn't on any blocklist yet, and can be thrown away the moment it's reported. Blocking newly registered domains for their first week or so closes that gap, at the cost of occasionally blocking a legitimate new site. Here's how it works and how to do it on a Windows PC.

Why scammers love brand-new domains

Most security blocklists work on reputation: a domain gets listed after it's been seen doing something bad. That leaves a window between a scam going live and the lists catching up, and the people running phishing campaigns build their operation around that window.

The typical pattern:

1. Register a lookalike domain (a bank, a parcel service, a streaming login) the same day the campaign starts.
2. Send the link by email, text or social media.
3. Collect passwords or card details for the hours or days before the domain is reported and blocked.
4. Move on to the next fresh domain.

Blocking by age instead of reputation flips that around. You don't need to know a domain is bad if you simply don't trust anything that new yet.

What blocking newly registered domains breaks

The trade-off is real, and worth knowing before you turn it on:

• A brand-new legitimate site won't load until it ages past the list's window or you allow it.
• Campaign and event pages often live on fresh domains.
• New services from companies you know sometimes launch on new domains, including sign-in or download links.

It doesn't affect established sites at all. For most people the occasional allow is a fair price; if you're a developer or marketer who registers and visits new domains constantly, it may not be.

How to block newly registered domains on Windows

You can use a filtering DNS service that offers an NRD option, or a list on your own network. On a single Windows PC, AdBolish does it locally:

1. Install AdBolish and click Restart as administrator, approving the Windows prompt, so it filters every app on the PC, not just one browser. (Rights don't carry over, so this is needed again after each Windows sign-in.)
2. Open Settings ▸ Protection ▸ What to block.
3. Turn on Newly registered domains. It blocks domains registered in the last week. It isn't included in the installer, so it downloads the first time you turn it on; the switch shows Downloading… until it's ready.

Lists are HaGeZi (GPL-3.0) and update once a day without a restart.

Pair it with the Threats list

Newly registered domains is the age layer. The Threats list, on by default, is the reputation layer: known malware, phishing, scam and command-and-control domains. Together they cover both the fresh scam and the one that's already been reported. Because both work at the DNS level, they protect every app, including a link opened from an email client or a chat app rather than the browser.

When a legitimate new site gets blocked

You'll know because the site simply won't load. To let it through:

• Quickest: click Site broken?, find the domain blocked in the last minute, and choose Allow for 1 hour or Always allow. Our guide on turning off an ad blocker for one site walks through it.
• Deliberately: open the Exclusions page, type the domain, and click Allow. Exclusions include subdomains, so allowing example.com also allows cdn.example.com.

If you'd rather not deal with it at all, switch Newly registered domains off again. The troubleshooting guide suggests exactly that if a site, game or app misbehaves after turning it on.

Check a suspicious link before you click

Got an email with a link you're not sure about? In AdBolish, open Exclusions and paste the domain or full URL into Check a domain. You'll get one of three answers:

• blocked, with the list and rule that matched, plus its network and category;
• excluded, meaning it's on a list but one of your exclusions allows it;
• allowed, meaning it isn't on any list.

"Allowed" isn't proof a link is safe; it just isn't on a list. Treat unexpected login links with suspicion either way, and type the address of your bank or delivery company yourself.

What this won't protect you from

• Old domains that get compromised. An established site that's been hacked isn't new.
• Phishing hosted on big platforms. Pages on shared hosting, file-sharing or form services use domains far older than a week.
• Malware already on the PC. Domain blocking isn't antivirus; keep Windows Security on.
• Other devices. AdBolish protects the Windows PC it's installed on, not your phone.

AdBolish blocks known malware and phishing domains out of the box, and newly registered domains when you want the extra layer, for every app on your Windows PC. It's free, runs locally, and never sends the domains you visit to us.