Tool 1.8

Domain age & WHOIS lookup: when was it registered?

See when a domain was registered, when it expires, its registrar and nameservers. Brand-new domains are a classic phishing sign. No personal data shown.

Online checkThe domain goes to our server (api.ethorns.com), which asks the domain's official registry (RDAP, or WHOIS where there is no RDAP) and keeps only the dates, registrar, status and name servers for 1 hour.

An automated check; it doesn't guarantee security.

How to use it

Type or paste the domain from the link or email, for example example.com. A subdomain such as login.example.com is looked up as example.com.
Press Check. Our server (api.ethorns.com) asks the domain's official registry, through RDAP or, where the registry has none (like .co or .mx), its WHOIS service.
Read the verdict: a domain registered in the last few days deserves extra suspicion.

When a domain's age tells you something

Before paying an online store you've never heard of, opening a “bank” link from a text message, paying the deposit on a rental you found online, or paying a supplier invoice with new bank details, check when the domain was born. Banks, government offices and established shops have domains that are years old. A store whose domain appeared a few days before a big sale deserves suspicion.

It's also useful for your own domain: check the expiry date. If a domain expires, the website and the email on it stop working, and once the registry releases it, anyone can register it.

A shop registered 12 days ago

Type tienda-ejemplo.com.co. If you paste pagos.tienda-ejemplo.com.co, we trim it to the main domain for common endings like .com.co. The verdict reads “Registered 12 days ago: be careful.”, in amber. Under 7 days it turns red, from 30 days to a year it's neutral, and after a year it calls it an established domain.

The table adds the details. Registrar is the company it was bought from. Expires is often exactly one year after the registration date, the minimum period: common for throwaway domains, but also for many honest ones. Status values like clientTransferProhibited are routine locks, not warnings. Nameservers show who runs its DNS, and DNSSEC signed says whether its DNS answers are signed.

What a domain's age doesn't prove

Old doesn't mean safe. Scammers also use domains that expired and were bought again, or hack old websites and hide a fake page inside them. And new doesn't mean fraud: every honest business had a two-week-old domain once. Treat the age as one sign next to the others.

Some registries publish no creation date, as with .pe, and a few offer no lookup service at all; the page says so instead of guessing. If a domain is being used for a scam, report it to the registrar shown in the table: registrars usually publish an abuse contact on their website.

FAQ

Why does a new domain matter?

Many phishing sites use domains registered days before the attack, because they get blocked quickly and a fresh one costs little. A bank, shop or government site will almost never be on a domain that's a week old.

Why can't I see the owner's name or email?

Registries hide personal data for privacy, and we don't show contact details even when a registry publishes them. You only get dates, the registrar and technical data.

Does it work for .co, .mx and other country domains?

Yes, for most. Registries without RDAP, like .co, .mx or .cl, are asked through their WHOIS service instead, and we keep only the dates and the registrar. A few registries, such as .pe, don't publish a registration date at all.

Is RDAP the same as WHOIS?

It's its modern replacement: the same kind of registration data, in a standard format and over HTTPS. Generic domains like .com use RDAP, while several country registries, like .co, .mx and .cl, still only offer WHOIS. We ask whichever the registry has and show the same fields either way.

What happens when a domain expires?

The website and email that depend on it stop working. There's usually a grace period to renew it with the registrar, whose length depends on the registry and the registrar. After that, the domain is released and anyone can register it, including someone who wants to reuse its reputation.

Guides for this tool

G1Is this link safe? How to check a link before you clickFind the real domain in a link, expand short links, spot look-alike letters and brand-new domains, and know what to do if you already clicked.
G4How to spot a fake website and check if a store is legitCheck the address, the domain's age and the page itself to tell whether a website or online store is real, and what to do if you already paid.
G9Fake rental listings: how to spot one before you payCopied photos, an owner who is abroad, a deposit before any visit: how to check a rental listing and its booking page, and what to do if you already paid.

1.1Is it a scam?Paste a message or link you received and see its warning signs: brand look-alikes, new domains, short links, scam wording.
1.2Scammed or hacked? What nowSteps for the first hours after a scam or a hack: a bad link, a shared code, a stolen WhatsApp, money sent.
1.3Is this file safe?See what a file from WhatsApp or email really is and spot attachment tricks: disguised programs, macros, PDF scripts, SMS-reading apps.
1.4Short link expanderSee where a short link (bit.ly, t.co, tinyurl…) really goes before you click it: every redirect, the final URL and warning signs.
1.5Website security scanPassive check of a website's homepage: HTTPS redirect, TLS certificate, HSTS, CSP, clickjacking, cookie flags and security.txt, with a grade and fixes.
1.6SSL certificate checkerCheck any site's SSL/TLS certificate: whether it's valid, when it expires, who issued it, which names it covers and the TLS version in use.
1.7Lookalike domain detectorCheck a link or domain for look-alike tricks: letters from other alphabets, digits for letters, a hidden real domain.
1.9Password generatorRandom passwords (8 to 128 characters) or passphrases, made in your browser with its cryptographic generator.
1.10Certificate decoderPaste a PEM certificate to read its subject, issuer, validity dates, SANs, key type and size, and its SHA-256 and SHA-1 fingerprints.
1.11Leaked password checkCheck if a password appears in known data breaches without sending it: with k-anonymity only 5 characters of its hash leave your device.
1.12Link cleanerStrip utm_, fbclid, gclid, si and other tracking parameters from links before you share them.
1.13Watermark an ID copyStamp who a copy of your ID is for, and the date, across the whole photo or PDF, then download a smaller copy with no photo data.
1.14Encrypt textEncrypt and decrypt messages or notes with a password (AES-256-GCM) in your browser.

╌╌ END ╌╌