Young Domain Guard (2026)

Browser extension that spots phishing sites by checking domain age over RDAP. Legitimate sites have old domains; phishing domains are almost always brand new. No server, no tracking, everything runs locally. Free and open-source on Chrome, Brave and Firefox.

Born from a real phishing incident, narrowly avoided. Why blacklists aren't enough A blacklist is reactive: it must first learn that a site is malicious. The numbers explain the problem: • Most phishing domains are blocked within 4 days • Their average active lifespan is about 16 days • Some live under 12 hours In other words, the block often lands after the damage. Domain age, by contrast, is knowable from the first second. How it works • Queries RDAP servers (the modern replacement for WHOIS) straight from the browser, via the rdap.org bootstrap • Derives age from the domain's registration date • Warns below a 30-day threshold by default, adjustable from 1 to 365 • 4-hour cache on results • Skips well-known domains (Google, GitHub, Amazon) to avoid pointless lookups Built in TypeScript on the WebExtensions API. No server: everything happens in the browser. The limits, owned • A young domain isn't malicious by itself: legitimate sites launch every day • An old domain isn't safe by itself: attackers sometimes reuse compromised aged domains • Not every TLD supports RDAP yet: some country-code TLDs remain WHOIS-only It's a signal, not a verdict.

Authors: Ilian A2Z