What brand-new web addresses actually look like
A huge share of the web’s worst behaviour comes from addresses that are only days old. We looked at a large sample of them, and found something most advice gets wrong.
Why a domain’s age tells you so much
A scam has a short life. Someone registers an address on Monday, sends the messages on Tuesday, and has moved on by Friday — long before anyone has reported it or added it to a list. By the time the usual defences know the name, the campaign is over and the next one has a new address.
Age sidesteps that entirely. You do not need to know what a brand-new address is for in order to be suspicious of it, and treating the whole class as untrusted catches tomorrow’s scam as easily as yesterday’s.
There are far more of them than you would think
Most people picture a filter as being mostly about adverts. In practice, brand-new addresses outnumber advertising by a wide margin — they are the single biggest thing we keep track of, comfortably ahead of everything else combined.
Millions of new addresses appear every month. The overwhelming majority are never used for anything at all, which is its own tell.
Where they live
Here is where a large sample of them had been registered:
Over four in ten were .com — which is not what anyone expects. The common advice is that trouble lives in the cheap novelty endings, and it is true that the likes of .xyz and .top punch above their weight. But the single most popular home for a brand-new address is the oldest and most respectable ending there is.
So the advice you will read everywhere — just block the dodgy-looking endings — misses more than half of the problem, while breaking every ordinary business that happens to use one. It sounds sensible and it does not work, because the part of an address a scammer picks for appearances is the part that costs them nothing to change.
And the tail goes on for ever
Beyond the top ten, the sample spread across several hundred more endings — country codes, industry-specific ones, and a long drift of oddities with a handful of addresses each. Anyone maintaining a hand-written list of “bad endings” is playing a game they cannot win.
The names themselves look perfectly normal, too. Roughly a dozen characters, mostly letters, occasionally a number or a hyphen. There is no visual tell, which is the other half of the argument for judging an address by its age rather than by how it reads.
Using it yourself
Blocking new addresses is one of the categories you can switch on per profile. It is the boldest of them: occasionally a perfectly good business registered its address last week and you will not reach it. That suits a child’s tablet or a television more than it suits a work laptop, which is exactly why it is a per-device choice rather than something we decide for you.
The setup guide covers connecting a device, and parental controls covers running different policies on different devices, which is what makes a category like this usable at all.
About these figures
Taken from a large random sample of the new addresses we were tracking in September 2026, and rounded — the shape is the point, and the exact decimals would be out of date before you finished reading them. The mix shifts a little month to month; the headline has held every time we have looked.