A phishing campaign has a short life. The attacker registers a domain, gets a certificate, sends the emails and moves to another name within days. Threat intelligence feeds only learn about the domain after someone reports it. The hours in between belong to the attacker.
Why a domain's age matters
Almost every site employees visit daily has existed for years. A request from an accounting PC to a domain registered yesterday is not proof on its own, but it is a strong signal.
When Defender resolves a name, NameDefence asks the Manager for the domain's registration date. If it is newer than the number of days you set, your policy applies: block or just log. New domains you trust can be added to an allowlist.
Some domains' registration dates cannot be learned. There is a separate choice for those too: allow them, or treat them as new and apply the same policy. High-security organizations use the second option.
Lookalike domains
The attacker's second favorite method is imitating your brand: company-login.com, cornpany.com or companysupport.net instead of company.com. These names are dangerous for you and for your employees: an employee may click, a customer may be fooled.
NameDefence watches for this in two places:
- In your own DNS traffic: when a new name that resembles one of your protected domains by a changed letter or an added word is queried, an alarm fires.
- Across the internet: Certificate Transparency logs are scanned continuously. When someone gets an SSL certificate for a name resembling your brand, you hear about it before the site even goes live.
The similarity rules are tuned for real-world noise. For example, typo lookalikes are expected to share the first letter, so thousands of unrelated names that happen to contain a common word do not raise alarms.
Watch your own domains too
Forgotten records in your own domain are as dangerous as lookalikes. A CNAME still pointing at a deleted cloud service lets an attacker re-create that service and publish content under your subdomain. NameDefence regularly checks the records of your protected domains and reports unexpected changes and dangling CNAMEs.
In short
A blocklist stops threats that have already been seen. A domain's age and its resemblance to your brand catch the threat being set up today, before anyone has reported it.