Threat actors often leverage newly registered domains (NRDs) in targeted social engineering campaigns. NRDs, typically defined as domain names registered within the previous 30 days, are deemed risky as they lack established historical reputation, threat intelligence telemetry, and domain categorization. Cybercriminals use NRDs to facilitate bypassing traditional web application filters, email gateways, and blocklists. By rapidly registering low-cost domain names and abusing registrars, threat actors establish disposable infrastructure that can be weaponized for fraudulent activities and then abandoned before security vendors classify the domains as malicious.
Threat actors use NRDs across diverse social engineering campaigns to establish perceived legitimacy and deceive targets. Traditional email security solutions heavily rely on reputation blocklists and known-bad signatures when computing spam and threat scores. NRDs are often categorized as “neutral” or “unknown” and may, therefore, reach victim inboxes. These domains are leveraged as delivery vehicles for phishing links sent via email, SMS text messages, or direct messaging platforms.
Impersonation:
Domains that mimic well-known organizations, government agencies, or business partners are typically registered using lookalike characters, minor misspellings, or often-used terms like portal or login. These domains host replicated landing pages designed to harvest employee credentials or MFA session cookies.
Search Engine Optimization Poisoning and Malvertising:
Attackers purchase search engine advertising space or manipulate search indexing using NRDs disguised as legitimate software download hubs, customer support portals, or billing services. Victims may then inadvertently download files containing infostealers and remote access tools.
Business Email Compromise:
Threat actors register variations of client, vendor, or internal corporate domains to initiate fraudulent wire transfers, reroute vendor payments, or manipulate direct deposit information. Since the domain was registered hours or days prior, domain validation checks (such as SPF, DKIM, and DMARC) can be configured legitimately by the attacker on their own infrastructure, creating an illusion of trust.
Recommendations:
- Enforce NRD DNS Filtering Policies by configuring secure web gateways, next-generation firewalls, and recursive DNS resolvers to block or place in quarantine access to domains registered within the last 30 days.
- Implement email gateway rules that flag, tag, or quarantine inbound correspondence originating from sender domains registered fewer than 30 days prior.
- Configure email banner warnings (such as “External Sender / New Domain Alert”) on messages originating from recently created domains.
- Subscribe to domain monitoring and protective DNS alerting services to gain real-time visibility whenever variations of their trademark, executive names, or core domains are registered by third parties.
- Verify URLs and email sender addresses, particularly when requested to provide account credentials or the transfer of money.
- When available, choose phishing-resistant MFA to prevent adversaries from successfully reusing credentials harvested via spoofed NRD login portals.
- Establish strict administrative verification protocols for all financial transactions, invoice changes, or banking modification requests. Always confirm changes through an official telephone number.