The 90-Day Deception: Anatomy of a Weaponized Domain

The most dangerous email doesn't come from a domain registered five minutes ago. It comes from one registered 91 days ago.

Every SOC analyst learns to treat Newly Registered Domains (NRDs) with extreme suspicion. It’s a core tenet of email security. Most security gateways apply heavy, automatic penalties to domains less than 30 days old. But professional threat actors know this. They don't fight the filter; they use its own logic against it.

They’ve industrialized patience. Instead of a quick smash-and-grab with an obvious lookalike domain, they cultivate their infrastructure. They build a domain's reputation methodically over months, making it appear legitimate to both automated systems and the hurried human eye. This is the lifecycle of a weaponized NRD, an assembly line for deception.

Days 0-10: The Quiet Registration

The process begins with a transaction. An attacker buys a domain from a registrar known for its lax oversight or favorable jurisdiction. The domain name itself is carefully chosen—not an obvious typo squat of a major brand, but something plausible and generic. Think `project-billing.net` or `secure-documents-hub.com`. It’s forgettably corporate.

For the first week or two, nothing happens. The domain is 'parked.' Its nameservers might point to the registrar's default page or simply resolve to nothing. Crucially, no MX records are published. From the perspective of the global email system, this domain doesn't handle mail. This isn't laziness; it's a deliberate tactic.

The goal is to put distance between the `CreationDate` in the WHOIS record and the first hostile email. Every day that passes makes the domain look less like an NRD. The attacker is simply waiting out the 30-day sandbox penalty that many reputation systems impose. It’s a cheap way to buy a sliver of legitimacy. The domain is now aging, indistinguishable from the millions of other legitimately parked or unused domains across the internet.

Days 10-45: Forging a Digital Passport

After the initial cool-off period, the attacker begins methodically building the domain's technical identity. This is the most critical phase, where they construct a flawless email authentication profile. They aren't aiming for a barely passing grade; they're aiming for a perfect score.

Laying the Authentication Foundation

First, they publish an SPF record (RFC 7208). It won't be a simple `a` or `mx` mechanism. Often, they'll use an `include:` pointing to a legitimate, high-reputation third-party sender like SendGrid or Mailgun. This makes their sending infrastructure appear to be backed by a trusted provider. An SPF record like `v=spf1 include:sendgrid.net ~all` looks perfectly normal.

Next comes DKIM (RFC 6376). They generate a public/private key pair, publish the public key via a TXT record, and configure their sending server to sign every outbound message. The goal is a perfect `dkim=pass` verdict, ensuring the message header and body haven't been tampered with in transit. This counters filters that look for unsigned mail.

Finally, they deploy DMARC (RFC 7489). A real company might cautiously start with a `p=none` policy. Attackers often skip straight to `p=quarantine` or even `p=reject`. This is pure performance. It signals to receiving mail servers that the domain owner is serious about email security, paradoxically making the eventual phish seem more trustworthy. The attacker is weaponizing compliance.

Days 45-90: Probing the Defenses

With an aged domain and impeccable authentication records, the attacker moves from construction to reconnaissance. They need to know how their creation behaves in the wild. Will their emails land in the inbox? Will links be flagged by a secure email gateway? This phase is about low-volume, high-value intelligence gathering.

The attacker sends a trickle of benign emails from their new domain. These aren't phishing emails yet. They're often empty or contain simple 'hello world' text. The destinations are a set of 'drop boxes'—accounts the attacker controls on major platforms like Microsoft 365, Google Workspace, and others.

Authentication-Results: mta.example.net; dkim=pass header.d=secure-documents-hub.com; spf=pass smtp.mailfrom=secure-documents-hub.com; dmarc=pass header.from=secure-documents-hub.com — A 'perfect' header verdict from a test email

They analyze the headers of the received messages. Did everything pass? Were there any warnings? Did the mail land in the inbox, spam folder, or was it quarantined? This feedback loop is essential. If a specific mail provider flags their IP, they'll rotate it. If a certain phrasing gets caught in a content filter, they'll adjust it. All this is done under the radar; the volume is too low to trigger volumetric reputation systems. The domain remains pristine while the attacker fine-tunes their attack vector.

Day 91+: The Attack Window

The preparation is complete. The domain is over 90 days old, possesses a flawless email authentication posture, and has passed initial reconnaissance. It's time to execute. This phase is characterized by speed and transience. The attacker knows the domain is a disposable asset.

High-Impact, Short Lifespan

The phishing campaign launches. A BEC-style wire fraud request, a credential harvesting page disguised as a Microsoft login, a malicious attachment posing as an invoice. The emails sail past many automated defenses. The domain isn't on any blacklist. It has a positive age. SPF, DKIM, and DMARC all return a `pass` verdict. For a Mail Transfer Agent (MTA) making a split-second decision based on reputation signals, this email looks clean.

The attack window is short, often lasting just a few hours. The goal is to maximize the number of victims before incident response teams and automated systems catch on. Once the first user reports the phish, the clock is ticking. Within hours, the domain and its associated IPs will be reported, analyzed, and added to global blacklists.

Burn and Reregister

The attacker doesn't care. To them, the domain is now 'burned.' They abandon it completely, sometimes wiping the DNS records to hinder investigation. They will not renew it. The investment—a few dollars for registration and a few hours of setup—has already paid off. While that domain dies, the next batch of domains, registered 90 days ago, are just entering their own attack window. It's a continuous, industrialized cycle.

Unmasking the Sleeper Cell

Blocking all domains under 90 days old isn't feasible, and as we've seen, patient attackers will simply wait you out. Defending against this TTP requires moving beyond static, point-in-time checks and embracing a historical view of a domain's behavior.

This is where passive DNS (pDNS) history becomes an invaluable tool for any analyst. Instead of just seeing that a domain *has* an SPF record, pDNS can tell you *when* that record was created. A domain that sat dormant for 60 days with no mail-related records, then suddenly had perfect SPF, DKIM, and MX records configured simultaneously, is highly suspicious. Legitimacy is messy; it evolves over time. Abrupt perfection is a red flag.

Look for the story in the data. Did the domain's A record point to a parking page IP for two months before switching to a new host? Did the nameservers change right before the email records were created? Correlate this intelligence. Use pDNS to find other domains sharing the same nameservers or IP addresses. A single sleeper domain might be part of a much larger, undiscovered campaign infrastructure.

The takeaway

Attackers have learned our playbook. They know we check for SPF, DKIM, and DMARC, so they perform compliance theater. They know we distrust NRDs, so they age their domains. They have adapted. Our defense must adapt as well.

Hunting this pattern requires a shift in perspective. You're no longer just checking a domain's current state; you're investigating its biography. The most telling signals are not in the 'pass' or 'fail' verdicts, but in the timeline and context of how the domain acquired them. This is why tools that fuse domain intelligence, passive DNS, and deep header analysis are critical. A platform like MailSleuth.AI can surface the timeline of a domain’s behavior, showing you the difference between a genuinely new sender and a predator playing the long game.