Cybercrime: $7 Million Invested in Expired Domains

Cybercriminals invested nearly $7 million in expired domains in the first half of 2026 to exploit the traffic and reputation of these sites. This tactic allows them to redirect unsuspecting users to fraudulent websites and malware. The DNS threat intelligence company Infoblox refers to these expired domains as dropcatch domains, which are registered by other parties after their release. From January to June 2026, 50,400 expired domains were registered that had previously been used by cybercriminals. These domains provide a valuable opportunity to take over existing traffic streams and enhance the credibility of the new operators.

The use of such domains is a growing problem that significantly jeopardizes online security. Attackers utilize these domains to disguise their fraudulent activities. They are often used for phishing attacks, where users are tricked into revealing personal information. The registration of these domains frequently occurs in large batches, making it difficult for authorities to identify and track those responsible. Infoblox has found that the use of dropcatch domains is not limited to individual fraudsters but is also employed by organized groups.

These groups often have extensive resources and networks to coordinate and optimize their activities. Analysis of the registered domains shows that many of them previously represented legitimate businesses or services. The security situation is exacerbated by the fact that many users are unaware of the risks. They often rely on the reputation of the domain without verifying the actual security of the website. This leads to them easily falling victim to fraud and malware, underscoring the need for education and security measures.

Authorities and security firms are working to combat this threat. Initiatives to monitor and analyze domain registrations are being intensified to detect suspicious activities early. Nevertheless, the challenge remains, as cybercriminals continuously develop new methods to conceal their attacks. Another aspect is the legal situation surrounding the registration of expired domains. In many countries, there are limited options to address the abusive use of these domains.

This results in many attackers remaining unpunished and able to continue their activities unhindered. The development of technologies to detect and defend against such threats is crucial. Companies and organizations must regularly update their security protocols and provide training for employees to raise awareness of cyber threats. Investments in security solutions are essential to ensure the integrity of online services. The situation is further complicated by the increasing number of internet users and the growing digitization of services.

According to current statistics, over 4.9 billion people worldwide use the internet, significantly enlarging the attack surface for cybercriminals. The need to implement effective security measures is thus becoming increasingly urgent. Infoblox warns that the trend of using expired domains could continue to rise in the coming months if no effective countermeasures are taken. The company recommends that businesses take proactive steps to protect their online presence and detect potential attacks early. The security gap created by the use of these domains affects not only individuals but also companies and institutions that rely on a secure online environment.

The challenge of combating cybercrime remains one of the greatest tasks for the digital future. Infoblox's analysis shows that the registration of dropcatch domains poses a serious risk that cannot be ignored. The company has already taken measures to minimize the impact of this threat and ensure the safety of its customers. Infoblox's data indicates that the number of registered dropcatch domains has increased exponentially in recent years, highlighting the urgency of the situation. Cybercrime is constantly evolving, and the security industry must adapt to respond effectively.

The security gap created by the use of these domains affects not only individuals but also companies and institutions that rely on a secure online environment. Infoblox has already taken measures to minimize the impact of this threat and ensure the safety of its customers.