grey<p>Friendly reminder that you should be blocking all newly registered domains for your end users. Free lists like the NRD (<a href="https://github.com/xRuffKez/NRD" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/xRuffKez/NRD</span><span class="invisible"></span></a>) exist. Microsoft Defender for Endpoint also has a built in list you can enable via policy.</p><p>IMO everyone should do 365 days but even 30 or 90 will save you so much headache.<br><a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DNS</span></a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/FastFlux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FastFlux</span></a></p>