Time horizon difference. Legitimate businesses think in years. Spammers think in months.
This creates measurably different registration behaviors that Google’s patent identifies as potential signal.
The spammer economics
Spam site expected lifespan: 3-12 months.
Revenue model: extract maximum value before penalty or detection.
Domain cost: minimize. Every dollar saved is profit.
Typical pattern:
- Register 1 year
- Build spam site immediately
- Monetize aggressively
- Abandon when penalized
- Register new domain
- Repeat
Multi-year registration for spam site = paying for years you won’t use.
No rational spammer invests in domain longevity. The domain is disposable by design.
The legitimate business economics
Business expected lifespan: 5-20+ years.
Revenue model: sustainable growth over time.
Domain cost: trivial relative to business value.
Typical pattern:
- Register multi-year (often 5-10)
- Build site gradually
- Protect domain as brand asset
- Renew indefinitely
- Domain becomes more valuable over time
Losing domain to expiration = catastrophic. Years of brand equity, links, traffic – gone.
Multi-year registration is insurance, not investment. The cost is nothing compared to the risk.
The behavioral signal
Google’s patent recognizes this divergence:
1-year registration doesn’t mean spam – but it’s consistent with spam behavior.
Multi-year registration doesn’t mean legitimate – but it’s consistent with legitimate behavior.
Combined with other signals, registration length contributes to pattern recognition.
Single factor = meaningless.
Factor within pattern = informative.
The false positive problem
Many legitimate sites use 1-year registration with auto-renew.
Technically: renewed annually = 1-year registration at any given moment.
Behaviorally: equivalent to long-term commitment if auto-renew is reliable.
This is why registration length alone can’t be strong signal. Too many false positives.
How do spam network operators structure domain registration to minimize costs while maximizing output?
Industrial efficiency in domain disposability.
Volume economics:
Spam network might operate 500-5000 domains simultaneously.
At $10-15/domain/year:
- 1000 domains × 1 year = $10,000-15,000
- 1000 domains × 5 years = $50,000-75,000
The difference funds significant spam infrastructure.
Rotation strategy:
Register in batches. Use until penalized. Abandon. Register replacement batch.
Average domain lifespan: 4-8 months.
12-month registration captures full useful life with minimal waste.
Registrar selection:
Budget registrars with minimal verification.
Often: offshore registrars, cryptocurrency payments, anonymous registration.
No relationship building. Pure transactional.
Bulk registration patterns:
Hundreds of domains registered simultaneously.
Similar naming patterns (keyword variations, misspellings, location + service combinations).
Single payment method. Similar WHOIS details (even when private).
These patterns are themselves signals – registration length is just one component.
What WHOIS patterns beyond registration length signal spam versus legitimate sites?
Multiple data points create composite signal.
Registration date clustering:
Legitimate: domains registered over time as business needs arise.
Spam: batches of domains registered on same day/week.
50 domains registered within 24 hours by same registrant = spam network indicator.
Registrar reputation:
Legitimate: mainstream registrars (GoDaddy, Namecheap, Google Domains).
Spam: registrars known for lax enforcement, anonymous registration, spam tolerance.
Certain registrars have reputation scores within Google’s systems (speculated, not confirmed).
WHOIS history volatility:
Legitimate: stable ownership, minimal changes.
Spam: frequent ownership transfers, privacy setting changes, registrar switches.
Instability suggests domain trading or ownership obfuscation.
Name server patterns:
Legitimate: stable name servers, often registrar default or premium DNS.
Spam: frequent NS changes, shared NS across hundreds of unrelated domains, bulletproof hosting NS.
Name servers reveal infrastructure relationships.
Contact information consistency:
Legitimate: real business info, matches website contact page.
Spam: generic info, PO boxes, disconnected phones, fake addresses.
Pre-GDPR, this was rich signal. Post-GDPR, less available but still exists for some registrations.
How do domain marketplaces and expired domain auctions affect the registration length signal’s reliability?
Significant noise injection.
The secondary market problem:
Legitimate business buys expired domain for brand match.
Domain was originally registered 10 years ago – by someone else.
Current owner registered 0 years ago.
Which registration length counts?
Google’s options:
Count original registration: rewards domain buying, not domain building.
Count current registration: ignores domain history value.
Track ownership changes: complex but more accurate.
The auction distortion:
Expired domain auctions feature domains with long registration histories.
Buyers expect authority transfer.
But registration length signal (if it exists) attached to original owner’s behavior, not buyer’s.
Signal becomes meaningless when ownership changes frequently.
Practical impact:
The more active the domain secondary market, the less reliable registration length as legitimacy signal.
Google likely knows this. May explain why registration length is weak or unused signal.
The signal made sense in 2005 when most domains were registered by the entity using them.
In 2024 with mature domain marketplace, original intent no longer inferable from registration data.
Why might Google weight recent registration behavior more heavily than historical
…