Use DNS registration info as a heuristic

[sambacha]

instead of maintaining a list of disallowed domains, instead perform a lookup on the domain name registration date and establish a threshold (eg 45 days) to which domains would be treated as suspicious.