[rekabis]

> The single best signal for identifying a phishing domain is the domain registration date

I guess the authors have never heard of domain washing?

Because IME a majority of domains from serious and large-scale spammers are not new - they are abandoned domains, where the spammer is counting on that domain’s prior reputation to bypass any filtering.

[dc396]

This would argue that change of ownership of a domain should be treated equivalently to creation of a domain. Of course, given GDPR (or rather how the registrars have chosen to interpret GDPR to reduce their legal liability risk), ownership information is now unavailable, so all you have to go on is the registration modification timestamp. Unfortunate.