Domain timeline: using RDAP to tell how long a relay site has actually been running

Why the timeline comes first

How long a site has existed filters faster and harder than price. Prices can be mislabelled and claims can be inflated, but a domain registration date cannot be changed.

That said, an old domain is not automatically good and a new one is not automatically a scam. The timeline tells you which stage the site is at and how much money you should risk on it.

Four time fields

How to query

.com / .net: RDAP is reliable

curl -s https://rdap.verisign.com/com/v1/domain/example.com \
  | python -c "import json,sys; d=json.load(sys.stdin); \
      [print(e['eventAction'], e['eventDate'][:10]) for e in d['events']]"

Output looks like:

registration 2026-03-09
expiration   2027-03-09
last changed 2026-03-09

One command, structured JSON, no HTML parsing.

.ai / .cc / .store: coverage is patchy

• .ai: most registries expose no RDAP; fall back to a whois site
• .cc: some endpoints return empty results
• .store: the registry RDAP often returns only notices, with no events array

When you fall back to a whois site, remember it caches. We have seen a whois page whose stated fetch date was three weeks behind the current day, meaning the record was stale. Before acting on a conclusion, cross-check with a second source.

Certificates

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates

Three profiles

Profile A: two-year term, registered over a year ago

registration 2025-06-xx
expiration   2027-06-xx

Two-year registration means the operator is willing to commit for two years. The most stable bucket.

Profile B: one-year term, registered 1-6 months ago

registration 2026-09-04
expiration   2027-09-04

Early stage. Not unusable, but keep the first top-up small and watch stability for a month.

Profile C: registered less than 30 days ago

registration 2026-10-24
expiration   2027-10-24

This is not "a new site to observe". It is nothing to observe yet; every check can only confirm that pages exist. Wait rather than test.

We saw an extreme case: a domain registered at 04:00 on the 24th, submitted for listing at 15:00 on the 25th, 35 hours later. Its terms were more specific than many established sites, and it still could not be listed. Documentation quality cannot substitute for operating history.

Expiry is also a signal

A site that has run for nearly three years but expires in two months is more worrying than one registered six months ago. The first has history but may not intend to continue; the second has simply not proven itself. Different risks.

Reading a privacy proxy

Withheld for Privacy, Domains By Proxy, PrivacyGuardian and similar mean the registrant is hidden.

• This is not inherently suspicious. Individual operators, compliance requirements and spam avoidance all lead here.
• It tells you exactly one thing: you cannot identify the entity through WHOIS.
• Fill that gap with the entity named in the terms, an ICP filing number in the footer, or the invoice header.

Privacy proxy plus no entity in the terms plus no filing in the footer is the combination that matters.

A decision table

Takeaways

• The registration date is the one hard number; check it first.
• Verisign RDAP handles .com in one command; .ai, .cc and .store need whois plus cache awareness.
• Certificate issuance is not site age.
• Time left before expiry hints at whether the operator intends to continue.
• A privacy proxy is not evidence of wrongdoing, but it does mean entity information must come from the terms or an invoice header.