Cybercrime: Millions for Expired Domains

In an alarming development, cybercriminals invested nearly 7 million dollars in expired domains in the first half of 2026. These domains are used to take over the traffic and reputation of former websites and direct unsuspecting users to fraudulent sites and malware. According to the DNS threat intelligence company Infoblox, these expired domains are referred to as "Dropcatch Domains," as they receive a second chance after they are no longer registered.

The practice of acquiring expired domains is not new, but it has gained momentum in recent years. Cybercriminals exploit the existing reputation and traffic of these domains to disguise their fraudulent activities. This tactic allows them to reach a larger number of victims, as users often do not realize that they have landed on a fraudulent site.

In the first half of 2026, a total of 50,400 expired domains were registered, which are being used by cybercriminals for their purposes. This figure highlights the growing interest in this method to access users' data and money. The attackers often use social engineering techniques to gain users' trust and persuade them to disclose personal information.

The use of expired domains is particularly effective, as many of these sites previously had legitimate content. Users who visited the domain before may be tempted to revisit the site without noticing that it is now being used for fraudulent purposes. This tactic poses a significant threat to online security and requires an increasing awareness of the dangers associated with visiting unknown or suspicious websites.

The Role of DNS Threat Intelligence

DNS threat intelligence plays a crucial role in the fight against this type of cybercrime. Companies like Infoblox analyze and monitor domain registrations to detect potential threats early. By identifying expired domains that are taken over by cybercriminals, security measures can be implemented to protect users.

The challenge is that many of these domains are quickly registered, often within minutes after their expiration. This requires a proactive approach to monitoring and analyzing domain registrations. Security researchers are working to recognize patterns and identify suspicious activities to prevent the spread of malware and fraud.

The impact of these activities is far-reaching. Businesses and individuals who fall victim to such scams can suffer significant financial losses. Additionally, the loss of personal data can lead to identity theft, which can have long-term consequences for those affected. The need to be aware of the risks online is more important than ever.

Cybercrime is constantly evolving, and the methods of attackers are becoming increasingly sophisticated. The use of expired domains is just one of many tactics employed by cybercriminals to achieve their goals. The security community must continuously adapt and develop new strategies to counter these threats.

The investments in expired domains by cybercriminals are a concerning trend that underscores the need to take online security seriously. Users should be aware of the dangers and take precautions to protect themselves from fraud and malware. Monitoring domain registrations and analyzing threats are crucial to ensuring safety on the internet.