Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware

Attackers are exploiting expired domains by purchasing them and leveraging their existing reputation, traffic, and DNS history to deliver malware, conduct scams, and establish command and control infrastructure. Approximately 65,000 previously owned domain names are re-registered daily, with nearly 20% of new domain registrations in the first half of 2026 being "dropcatch" domains, which have a prior history¹. These domains can end up in the hands of legitimate investors or researchers, but many are acquired by malicious actors who recognize the value of exploiting a domain's existing credibility. This tactic allows attackers to bypass traditional security measures and increase the likelihood of successful malware delivery. The reuse of expired domains poses a significant threat to online security, as it enables attackers to blend in with legitimate traffic and exploit trust in established domains, so practitioners must be vigilant in monitoring domain registrations and reputation to mitigate this risk.