Investigation: the scam website is usually less than a month old

Updated on November 7, 2026 · 4 min read

In short: we looked up when 264 domains that fraudulent investment ads led to were registered. Half were 27 days old or less on the day we saw the ad, more than a quarter were under a week old and almost eight in ten were less than three months old. Checking a website’s age takes a minute and is free. It is one of the easiest signs to see, although it is not proof.

What we did

For each domain in our database we queried the public domain registry (RDAP) in November 2026. We compared the registration date with the first day we saw it in an ad.

Each row includes the ones above it. Only 8 of the 264 were more than a year old. The median is 27 days.

A serious financial company does not appear on your phone with a week-old website.

Beware of old domains

An old website guarantees nothing. Those 8 domains over a year old include websites that look like small businesses and blogs unrelated to investing. Most likely they have been tampered with or the domain has changed hands. We have already seen that pattern on hacked legitimate websites.

So the sign only works in one direction: a very new website is a bad sign, but an old website is not a good sign.

The “brokers” last a little longer

We also looked at 42 domains of the broker websites where victims ended up. They are older: the median is 84 days, and 9 are over a year old.

That makes sense. The ad page is disposable, because it falls as soon as it is reported. The fake broker is where the business is: it has to last as long as the relationship with the victim. Even so, half were less than three months old. A company with “years of experience” does not usually have a website that is 84 days old.

Registered in batches

Registrations cluster around what the current campaign needs. Of the ad domains with a date, 125 were registered in October 2026 and 33 in the first days of November. Some days had more than ten registrations, such as 27 October and 7 October.

Some other patterns:

• Half end in .com. The rest are split mainly between .info, .click, .pro and .digital, cheap extensions that a financial institution rarely uses for its main website.
• Few registrars. The most common are Dynadot (96), Namecheap (40), NameSilo (33), Sav (29) and Spaceship (23). They are legitimate companies, and anyone can register a domain with them.
• Almost all behind the same shield. 275 of the 306 ad and broker domains with data use Cloudflare’s name servers, a legitimate and very common service. It hides the real server, which makes it harder to know where the website is hosted.

How to check in a minute

1. Copy just the domain, for example name.com, without whatever comes after it.
2. Go to ICANN’s official lookup tool: lookup.icann.org.
3. Look for the registration date (Created or Registration date).

If the website promises years of experience and the domain is weeks or months old, stop there. Some country domains do not show the date in that tool. In that case, look for the registry for that extension.

And remember that this is only a sign. What really decides it is whether the company is authorised, because many scams change website every few days.

Limitations of this investigation

• We only count domains with a public date: 264 of the 292 ad domains in our database.
• The date we use is the first time we saw the ad, not the first time it was published. We started monitoring on 26 October 2026, so some domains will have appeared earlier and their real age would be lower.
• A domain may have been re-registered after expiring, in which case the date is not that of its first use.
• A registrar or service appearing here does not imply any connection with the scam.