ATTACKERS are increasingly purchasing expired domains to exploit their historical reputation, traffic, and DNS records for illicit activities like malware distribution. In the first half of 2026, nearly 20% of new domain registrations were previously owned, called dropcatch domains, often seen as more valuable than new domains. A notable threat actor, Sable Squirrel, has spent $7 million on these domains for operations including illegal streaming and malware infrastructure.
The report highlights that expired domains can contain residual traffic, email directed to former owners, and lingering DNS records, making them attractive to cybercriminals. The article warns defenders to scrutinize domain age and reputation, as older domains may not be trustworthy when transferred to new owners.