Cybercriminals Invest Nearly $7 Million in Expired Doments for Large-Scale Malware and Scam Redirection

According to DNS threat intelligence firm Infoblox, cybercriminals acquired roughly 50,400 expired domains during the first half of 2026, investing approximately $7 million in the process. These actors employ a technique known as dropcatching, where expired domains become available for public registration and are immediately snapped up by a second party.

The inherited domains retain their prior web traffic, search engine rankings, and backlink profiles, which threat actors exploit to lend credibility to fraudulent sites. Victims arriving at these domains are redirected to scams, phishing pages, and malware delivery endpoints. The practice leverages the trust and visibility associated with established domains to bypass initial user suspicion.

Infoblox noted that the domains are registered through various registrars globally, making the operation diffuse and difficult to attribute to a single source. While no zero-day exploits or software vulnerabilities are involved, the abuse of domain registration processes presents a significant vector for large-scale redirection attacks.

The report underscores the need for heightened domain monitoring and user awareness, as the redirection relies on inherited trust rather than technical exploits of software.