What actually happens when you register a domain
Typing a name into a registrar’s search box and clicking “buy” feels like a single transaction. It isn’t. Registering a domain triggers a handoff between at least three separate parties, writes a record into a global distributed database, and pushes a delegation instruction into a system that every other computer on the internet trusts by default. Most of that machinery is invisible unless you’re the kind of person who has to think about how it gets abused, which is where this gets interesting.
The three-party system
Domain registration runs on a strict hierarchy: registry, registrar, registrant.
The registry operates the authoritative database for a top-level domain. Whoever runs .com, .io, or .xyz is the single source of truth for which second-level names under that TLD exist, who they’re delegated to, and what nameservers answer for them. Registries don’t sell domains directly to the public in most cases. They sell through registrars.
A registrar is an ICANN-accredited business that has a contractual relationship with one or more registries and a technical interface into their systems. When someone buys a domain from a registrar’s storefront, the registrar is acting as a broker: it takes the order, handles payment, and then talks to the registry on the buyer’s behalf.
The registrant is just the person or entity whose name ends up on the record. That’s the layer most people think registration begins and ends at, but it’s actually the last stop in the chain, not the first.
The moment you click buy
The interesting part happens in the seconds after checkout. The registrar sends a query to the registry to confirm the name is actually available, since domain inventory changes constantly and cached availability checks go stale fast. Once confirmed, the registrar issues a create command to the registry over EPP, the Extensible Provisioning Protocol, which is the standard interface registrars use to talk to registries. EPP is XML-based and runs over a dedicated port rather than the web, and it’s what actually writes the new domain into the registry’s database, assigns it a creation and expiration date, and links it to the registrant’s contact and nameserver information.
At that point the domain exists in the registry, but it isn’t resolvable yet. Resolution depends on delegation: the registry has to publish glue records pointing to the domain’s authoritative nameservers, and those nameservers have to actually be configured to answer for the zone. If a buyer registers a domain and never points it at a nameserver, it sits in the registry as an inert record. Once nameservers are set, the change propagates as other resolvers’ caches expire based on TTL values, which is why a freshly registered or freshly repointed domain can take anywhere from minutes to roughly a day to resolve consistently everywhere.
Behind all of this sits a registry-level status system. Codes like clientTransferProhibit or serverHold control whether a domain can be moved, transferred, or is even allowed to resolve. These locks matter a lot in abuse response, which comes up later.
The identity layer nobody reads
Every domain registration is required to include registrant contact data, historically published through WHOIS and increasingly through its replacement, RDAP, the Registration Data Access Protocol that ICANN has pushed registries and registrars to adopt because it supports structured queries and access control that plain-text WHOIS never had.
Almost nobody actually shows their real contact details publicly anymore. WHOIS privacy or proxy services substitute the registrant’s real information with the privacy provider’s own contact details, forwarding email through an alias. This exists for legitimate reasons: WHOIS data used to be a direct pipeline for spam harvesters and harassment, and privacy protection was a reasonable response to that.
It also happens to be structurally useful for anyone trying to spin up infrastructure without attaching a durable identity to it. A phishing kit, an ad fraud landing page, or a malware command-and-control domain doesn’t need a real registrant behind it, and privacy proxies mean the public record won’t show one. This isn’t a loophole so much as a side effect of a feature built for a different purpose, and it’s a good example of how adversarial infrastructure usually doesn’t require anything exotic, just the ordinary tools used at the edge of their intended use.
Domain age as a signal, and a target
Fraud detection systems, ad networks, and email filters all lean heavily on one simple fact: legitimate businesses tend to register a domain and keep it around, while disposable infrastructure gets registered, used briefly, and abandoned. This makes the age of a domain, specifically how recently it was created, one of the most reliable low-cost signals available to defenders. A domain that was registered six hours ago and is already sending a burst of outbound mail or serving ad impressions looks very different, statistically, from one that’s been resolving quietly for three years.
This is also why malware operators historically leaned on domain generation algorithms, or DGAs, which compute large batches of pseudo-random domain names from a shared seed so that a piece of malware can try connecting to hundreds of candidate command-and-control domains without hardcoding a single one an analyst could just block. Only a handful of those generated names ever actually get registered by the operator at any given time, but the algorithm gives them disposability: if a domain gets taken down or sinkholed, tomorrow’s seed produces a fresh batch. Typosquatting works on a related but simpler principle, registering names that are one character off from a legitimate brand’s domain, betting on user error rather than algorithmic churn.
How the defensive side watches the pipeline
None of this happens in a vacuum, because domain registration is one of the most observable events in the entire abuse lifecycle. Every new registration is a matter of record at the registry, and several downstream systems watch that firehose in near real time.
Newly registered domain, or NRD, feeds are a standard input for security tools precisely because of the age signal described above: a domain under a day or a week old gets scored differently than an established one, and plenty of filtering products will hold or flag mail, ads, or connections tied to very fresh domains until they’ve built up some track record. Certificate Transparency logs add another observation point, since any domain that gets an SSL certificate issued (which is nearly all of them now, given how normalized HTTPS is) generates a public, append-only log entry the moment the certificate is issued, letting defenders watch phishing infrastructure come online almost as fast as it’s built.
Registrars themselves carry abuse obligations under their ICANN accreditation agreements, which require them to maintain an abuse contact and act on credible reports of illegal activity tied to domains they sponsor. In practice this ranges from prompt suspension to very slow response, and it’s a major reason bad actors gravitate toward registrars in jurisdictions with weaker enforcement or slower compliance culture. Registries can also intervene directly by placing a serverHold status on a domain, which stops it from resolving even if the registrar is unresponsive.
Where the seams are
None of this is airtight, and it’s worth being honest about where the gaps sit. Privacy proxies slow down attribution rather than eliminate it; registrars and, when compelled, courts can usually unmask a registrant behind a privacy service. NRD-based filtering catches a lot of throwaway abuse infrastructure, but it also generates false positives against legitimate new businesses whose only sin is being new, which is a real cost defenders have to weigh. Domain locking prevents casual hijacking but doesn’t stop social-engineering attacks against registrar support staff, which remains one of the more effective ways high-value domains get stolen. And jurisdictional arbitrage among registrars means abuse response speed varies enormously depending on where a domain happens to be sponsored, something no amount of technical protocol design fixes on its own.
The registration system was built for a trusting internet and has had defensive layers bolted onto it for three decades since. Understanding how the plumbing actually works, registry and registrar roles, EPP, WHOIS versus RDAP, delegation and propagation, domain age as a signal, is the difference between seeing a domain as just a name and seeing it as a piece of infrastructure with a traceable, if imperfect, paper trail.
If you want more of the internet’s adversarial plumbing explained from the inside, head back to the Hidden Internet homepage.
Get new guides and videos first — join the Telegram channel.