Checking domain age from the command line: A quick phishing red flag test

General Discussions
1

One thing I check first when a suspicious link lands in my inbox is domain age. Phishing and scam sites are almost always registered days or weeks before the campaign starts, so if a domain claiming to be your bank or a big brand was registered last month, that’s a strong signal something’s off.

Reminded me of Daniel’s Postfix spam auto-block setup; he’s inspecting parked domains to auto-block spam senders, which is basically the same principle: domain metadata as a trust signal, not just content filtering. Smart approach.

I put together a small bash script that does a similar lookup from the terminal using the WhoisFreaks API:

bash

#!/bin/bash
DOMAIN=$1
API_KEY="your_api_key"

curl -s "https://api.whoisfreaks.com/v2.0/whois/live?apiKey=$API_KEY&domainName=$DOMAIN&format=json" | jq '{domain: .domain_name, created: .create_date, registrar: .domain_registrar.registrar_name}'

Run it like:

bash

./checkdomain.sh suspicious-site.com

It returns the registration date and registrar in a couple seconds, no browser or WHOIS website needed. Handy for quick triage before deciding whether to dig further or just block the domain outright.

Also relevant: the Google Domains migration thread; a lot of registrars show up in that discussion, and registrar reputation is actually part of what I check too. Some registrars are magnets for throwaway phishing domains, so knowing who’s hosting a suspicious domain adds another data point.

Curious what other quick checks people here run before clicking or investigating a suspicious link. Do you automate any of this, or do you do it manually per case?

3 Likes
2

Hi Furqan. That’s a nice script; I think I should probably switch to using yours!

My anti-spam protection has been so good, I hardly ever get any spam attempts anymore. I used to get 100-200 a day, but then the FBI shut down the botnets, and that went to about a dozen a day. It has trickled off and now I get a few a week.

I get lots of relay attempts, but I no longer receive many actual spam attempts targeting my personal addresses. I almost think it’s sad that the spammers gave up, but maybe all those 550s finally got to them. :smiling_face_with_sunglasses:

2 Likes
3

Glad it’s useful, though honestly your setup sounds like it’s already doing the harder part. Catching parked domains from postfix logs and auto-updating blocked senders is a much tighter loop than what I’m doing, mine’s really just manual triage when something looks off, not a full pipeline like yours.

That drop from 100-200/day down to a few a week is a wild before/after. Good reminder that a lot of this stuff really is infrastructure-level (botnet takedowns, upstream blocklists) rather than anything we’re doing locally. Though I’d guess the volume that does get through now is probably more targeted/deliberate rather than spray-and-pray, which is almost a different problem to filter for.

Do you still keep the domain-parking check running even now that volume’s dropped, or has it mostly gone dormant since there’s less to catch?

1 Like