Criminals Spent Almost $7 Million Buying Expired Web Domains to Push Scams and Malware
Infoblox says 50,400 'dropcatch' domains were scooped up in the first half of 2026 to inherit the trust of the sites that came before them.
Key points
- Infoblox, a DNS threat intelligence firm, tracked 50,400 expired domain names bought by criminals in the first half of 2026.
- The buyers spent close to $7 million snapping the domains up the moment previous owners let them lapse.
- Infoblox calls the practice 'dropcatch': grabbing a name the instant it drops back onto the market.
- Reused domains send unsuspecting visitors to scam pages and malware downloads while borrowing the old site's search ranking and reputation.
- No binding federal rule yet targets dropcatching directly, even as regulators press registrars for stronger checks on who buys what.
A domain name is the address you type into a browser, like example.com. When the owner stops paying for it, the name expires and becomes available again.
Criminals have turned that quiet moment into a business.
According to Infoblox, hackers spent nearly $7 million in the first half of 2026 buying up 50,400 expired names. Infoblox calls the tactic 'dropcatch': the domain is caught the second it's released back onto the market. We covered a related pre-positioning approach on 1 July, when Unit 42 documented actors camping on domains that AI chatbots keep hallucinating; dropcatching is older and blunter, but the shared logic is the same: inherit trust you didn't earn.
The appeal is clear. An expired domain often carries years of inbound links, a position in Google's search results, and email addresses people still write to. A new owner inherits all of that on day one.
Why would a criminal want an old, expired domain?
Because it looks legitimate to both people and machines. A freshly registered site raises red flags with spam filters and browser warnings. A domain with a long history usually doesn't.
Buyers use that reputation to send visitors to fake shopping sites or investment scams, and to pages that quietly install malware, meaning software designed to steal data or take over a device. Search engines may still list the old site's pages, so a shopper clicking a familiar link ends up somewhere very different from what they expected. Emails sent from the domain are more likely to land in inboxes than in spam folders.
How does dropcatching actually work?
Registrars, the companies that sell domain names, release expired names back to the pool on a predictable schedule. Specialist services monitor that schedule and fire off automated registration requests the instant a name becomes available, often winning it in milliseconds.
Those services are legal and have legitimate uses. Investors trade domains the way others trade property. The problem is that the same speed and automation let criminals win valuable names before anyone else notices they were up for grabs.
| Metric | Figure |
|---|---|
| Dropcatch domains bought by criminals | 50,400 |
| Period | H1 2026 |
| Estimated spend | close to $7 million |
| Source | Infoblox DNS threat intelligence |
What can ordinary internet users do about it?
Treat a familiar-looking link with more suspicion than you used to, especially if the page feels off. Watch for sudden design changes or requests for payment details on a site that never asked before. If a bookmarked shop suddenly redirects somewhere unfamiliar, close the tab and search for the company fresh.
For businesses, the lesson is quieter but sharper: don't let your own domains expire. A lapsed marketing site or old campaign URL can be bought within hours and pointed at anything the new owner wants, with your customers still trusting the address.
Common questions
Is buying an expired domain illegal?
No. Buying a domain that has been released back to the market is legal. What the new owner then does with it, running a scam, hosting malware, impersonating the old brand, can be illegal on its own terms.
How can a company keep its old domains safe?
Set up auto-renewal, keep contact details current with the registrar, and maintain a written inventory of every domain the business owns, including ones no longer in active use.
