How would you decide what is legitimate ?

Better would be a "this site is suspiciously new" warning in browsers.

At $WORK, newly registered sites are blocked by default by the network appliance.