Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale.

DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available for registration and is then snapped up by another party.

During the first half of 2026, 50,400