We checked 21,433 websites with a known registration date. The strongest warning sign wasn't a missing padlock, a missing privacy policy or a sketchy design. It was the site's birthday.
Every verified.fyi report records when a site's domain was first registered. Put 21,433 sites in order of that date and the trust verdicts fall into a spectrum: red at the young end, green at the old end.
Of sites registered less than a week before we checked them, 85% were Suspicious or Dangerous. For sites more than 20 years old, it was 8%. The average trust score climbs at nearly every step along the way.
| Domain age | Sites | Avg score | Dangerous | Suspicious | Use caution | Mostly safe | Trusted |
|---|---|---|---|---|---|---|---|
| < 1 week | 1,166 | 26.8 | 303 | 688 | 149 | 25 | 1 |
| 1–2 weeks | 992 | 29.0 | 162 | 659 | 146 | 25 | 0 |
| 2–4 weeks | 293 | 33.9 | 41 | 156 | 76 | 20 | 0 |
| 1–3 months | 672 | 38.6 | 62 | 338 | 164 | 107 | 1 |
| 3–6 months | 642 | 41.3 | 43 | 295 | 177 | 121 | 6 |
| 6–12 months | 589 | 44.9 | 31 | 210 | 186 | 155 | 7 |
| 1–2 years | 687 | 53.8 | 14 | 149 | 203 | 279 | 42 |
| 2–5 years | 1,659 | 57.8 | 23 | 269 | 453 | 741 | 173 |
| 5–10 years | 2,600 | 61.8 | 29 | 305 | 595 | 1279 | 392 |
| 10–20 years | 5,050 | 65.8 | 48 | 446 | 924 | 2352 | 1280 |
| 20+ years | 7,083 | 69.6 | 37 | 535 | 1042 | 2783 | 2686 |
Domain age is one of the 200+ signals behind every verified.fyi score, so a gradient like this could be partly self-fulfilling. To check, we looked at a verdict we have no say in: whether the site was on Google's Web Risk threat list when we checked it.
Sites under a week old were on it 4.9% of the time. Sites more than five years old: 0.05%. That's roughly 100 times as often.
| Domain age | Checked | On the list | Share |
|---|---|---|---|
| < 1 week | 1,166 | 57 | 4.89% |
| 1–4 weeks | 1,285 | 35 | 2.72% |
| 1–12 months | 1,903 | 70 | 3.68% |
| 1–5 years | 2,343 | 8 | 0.34% |
| 5+ years | 14,731 | 7 | 0.05% |
Zoom in on the first month and the pattern gets sharper. 82% of the 2,451 sites under 30 days old were Suspicious or Dangerous, and 90% of those risky sites were less than two weeks old.
Our data can't follow a domain until it dies, but the drop-off after the second week fits what security researchers have long reported: scam domains are disposable. One costs a few dollars, gets used for a phishing or fake-shop campaign, ends up on blocklists and is dropped for the next one. Time is the one thing a scammer can't afford to spend.
| Days old | Sites | Suspicious or Dangerous |
|---|---|---|
| 0 | 25 | 23 |
| 1 | 132 | 113 |
| 2 | 225 | 198 |
| 3 | 220 | 183 |
| 4 | 171 | 146 |
| 5 | 209 | 177 |
| 6 | 184 | 151 |
| 7 | 208 | 177 |
| 8 | 186 | 160 |
| 9 | 165 | 138 |
| 10 | 160 | 135 |
| 11 | 128 | 107 |
| 12 | 77 | 57 |
| 13 | 68 | 47 |
| 14 | 44 | 33 |
| 15 | 25 | 18 |
| 16 | 30 | 23 |
| 17 | 22 | 16 |
| 18 | 18 | 10 |
| 19 | 17 | 9 |
| 20 | 10 | 8 |
| 21 | 15 | 11 |
| 22 | 14 | 10 |
| 23 | 14 | 9 |
| 24 | 14 | 8 |
| 25 | 15 | 10 |
| 26 | 12 | 6 |
| 27 | 14 | 7 |
| 28 | 15 | 8 |
| 29 | 14 | 11 |
If a shop is younger than the milk in your fridge, don't give it your card details.The one-line version of this report
We compared sites under a month old with sites more than five years old on the trust signals people are taught to look for. The results are uncomfortable.
Newborn sites were more likely to show a valid HTTPS padlock (96% vs 95%) and more likely to list company or legal-entity details (30% vs 19%). Privacy policies and terms pages were about as common on both. A padlock means the connection is encrypted, not that the person on the other end is honest. Certificates are free and take seconds, and legal boilerplate takes one copy and paste.
What newborn sites rarely have is anything that takes time or a real operation to build. Only 17% had any history on the Wayback Machine (vs 74%), 30% had email set up on the domain (vs 89%), and almost none ranked among the world's top million websites, against 23% of established sites.
Easy to add to any site. The padlock and legal pages don't separate new sites from established ones at all.
Hard to fake quickly, and usually missing on newborn sites.
| Signal | Under a month old | Over 5 years old |
|---|---|---|
| Valid HTTPS padlock | 96.5% | 94.7% |
| Company or legal-entity details | 29.8% | 19.2% |
| Privacy policy and terms | 42.6% | 46.9% |
| An About page | 52.6% | 69.4% |
| Contact details | 39.2% | 63.6% |
| Social media profiles | 19.2% | 56.8% |
| Email set up on the domain | 30.5% | 88.6% |
| Any history on the Wayback Machine | 17.3% | 73.8% |
| Ranked in the top 1M sites | 0% | 23.2% |
Two caveats matter, and scammers exploit both.
212 sites registered within the past month had Wayback Machine snapshots from at least a year before that registration date. That's the fingerprint of an expired domain picked up by someone new, often to inherit its old reputation and links. The registration date resets when a domain changes hands, so check its history as well as its age.
14% of the sites we rated Dangerous were more than five years old. They include hacked or abandoned sites, domains whose owners let them lapse, and pages on someone else's long-established platform, which inherit that platform's age.
Every verified.fyi report shows the domain's age and archive history. Any WHOIS lookup will show the registration date too.
A brand-new site asking for payment or a login deserves a second look. Reach the company through a search engine or app you already trust, not the link you were sent.
HTTPS only means nobody can eavesdrop on the connection. 93% of the dangerous newborn sites we found had a valid one.
Paste any link. We'll show its age, its history and 200+ other trust signals in seconds.
Free to quote, chart and republish with a link back to this page. Journalists: get in touch for other cuts of the data.