{"id":13993,"date":"2026-08-13T06:00:26","date_gmt":"2026-08-13T13:00:26","guid":{"rendered":"https:\/\/www.infoblox.com\/blog\/?p=13993"},"modified":"2026-08-13T06:01:07","modified_gmt":"2026-08-13T13:01:07","slug":"drop-something-dont-worry-someone-caught-it","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/drop-something-dont-worry-someone-caught-it\/","title":{"rendered":"Drop Something? Don\u2019t Worry, Someone Caught it"},"content":{"rendered":"

An old domain is not always old trust. Dropcatch activity gives previously registered domains a second life, sometimes under very different ownership. <\/p>\n

Infoblox Threat Intel | Dropcatch series | Part 1 of 3<\/strong><\/p>\n

Executive Summary<\/h3>\n

Every day, tens of thousands of domain names expire and become available for registration. Some fade away and are never seen again. Others get a second chance. We refer to these as dropcatch domains: the domain was dropped, became available again, and someone caught it. This isn\u2019t just our name; it\u2019s widely used. There\u2019s even an auction service called DropCatch.com.<\/p>\n

During the first half of 2026, we observed over 50k dropcatch domains a day in the gTLDs alone\u2014when we add in various ccTLDs that number rises to around 65k. That\u2019s an astounding number when you put it next to the total of new registrations every day. For the gTLDs, nearly 20% of all observed registrations are dropcatch. In other words, one of every five newly registered domains had a prior life, sometimes several.<\/p>\n

These domains can be particularly interesting, even dangerous, because they inherit reputation and sometimes connections from their previous life. For example, a domain that was originally registered 10 years ago, later dropped, and then acquired by someone else may still carry signals associated with its long history. Researchers, security products, and reputation-based algorithms may view it more favorably than a genuinely brand-new registration. Threat actors know this and take advantage of it.<\/p>\n

In this first post of our three-part blog series, we focus on the fundamentals: why domains get dropped, how they get caught, and how frequently they reappear under a new registration. We also explore the challenges involved in identifying these domains at scale, particularly when creation date information is unavailable. In blogs two and three, we’ll dive into the threat actors that actively catch dropped domains and explore what happens after those domains fall into new hands.<\/p>\n

Disclaimer: The domain name industry (as opposed to the Domain Name System) is a complex one and is not our area of expertise. Take our numbers as accurate, but the nuances of domain registration with a grain of salt.<\/em><\/p>\n

Not Every Domain Lives Forever<\/h3>\n

Dropped domains come in all shapes and sizes. Some were once owned by failed small businesses. Others belonged to critical supply chain components. Sometimes they are intentionally abandoned, but they can also be lost through something as simple as a missed renewal notice, a forgotten email account, or an employee responsible for renewals leaving the company. Companies shut down, websites disappear, priorities change, and domains that once seemed important are no longer worth maintaining. Threat actors contribute to this cycle too. They often register domains in bulk and abandon them rather than paying renewal fees.<\/p>\n

Domain management is trickier than people realize. Some domains were only ever intended for “internal” use, so no one immediately notices when they disappear. Missing renewals for these domains among large collections is extremely easy and extremely common. This happened to us. There\u2019s a period where you can reclaim the domain after its expiration, but after that it may be sold at auction or eventually become available for registration again. A few missed emails and it\u2019s too late to get it back. In our case, the new owner wanted $40k to return the domain to us. We decided to pass, and the domain is still up for sale. Today the asking price is over $52k. That seems like a lot, but we\u2019ve talked to other organizations who were asked to pay over $100k to recover their lost internal domain.<\/p>\n

We’ve seen domains associated with temporary events, charitable initiatives, world crises, political campaigns, small businesses, and personal blogs all make their way back onto the open market. Mergers and acquisitions can contribute as well. When organizations restructure, domains are often left behind in the wake of the transition, with ownership and renewal responsibilities becoming unclear.<\/p>\n

We could keep going, but by now the point is probably clear: domains get dropped for all sorts of reasons.<\/p>\n

By the Numbers: Sizing Up the Catch<\/h3>\n

Measuring dropcatch activity is not as straightforward as it might initially seem. In theory, a dropcatch occurs when a domain that was previously in use becomes available again and is subsequently re-registered. Detecting such events at scale relies heavily on access to creation date information and a rich history of domain names. One of the clearest signals of a drop is when a domain known to have existed previously appears with a new creation date. Without that information, distinguishing a dropped and re-registered domain from a brand-new registration becomes significantly more difficult.<\/p>\n

Throughout this report, we focus on domains that reappear with a new creation date after a prior registration. When a domain changes ownership before it is deleted, it typically retains its original creation date and therefore is not included in our dataset.<\/p>\n

The first challenge with creation dates is that their availability varies considerably across top-level domains (TLDs). For generic TLDs (gTLDs), registry operators are required to provide creation dates under ICANN’s registration data policies<\/strong><\/a>, making drop activity relatively straightforward to measure. Many country code TLD (ccTLD) registries, however, do not publicly provide creation dates. In addition, there are ways a domain can transfer without having a new creation date. As a result, counting dropcatch domains is fundamentally a data-availability problem.<\/p>\n

Another challenge is domain history. The WHOIS record may indicate a domain name was just created today, but was it created in the past? That\u2019s also a non-trivial counting problem. We keep track of every domain we\u2019ve ever seen and have done so for years. When we detect a newly observed domain, we compare it against our historical records to see if we\u2019ve seen it in the past. If we detect a new registration, we consider it a dropcatch. There are quite a lot of nuances in identifying these domains at scale, especially when we look at ccTLDs or domains with public suffixes. Counting is hard!<\/p>\n

If we consider only gTLDs, on average, 50,400 dropped domains are re-registered each day, accounting for nearly 20% of all daily gTLD registrations. When we include ccTLDs, we detect around 65,000 dropcatch domains a day and the overall percentage of dropcatch is still about 20%. See Figure 1 for a graphic illustration.<\/p>\n

\"Figure<\/p>\n

Figure 1: Overall average of daily dropcatch domains across gTLDs in 2026<\/p>\n

To understand where that activity concentrates, we looked at every gTLD with at least one dropcatch domain since the start of the year. Like many things we measure, the distribution follows a familiar long-tail pattern: a relatively small number of observations account for most of the volume. Despite observing dropcatch activity across a large number of gTLDs, approximately 92% of all dropcatch domains came from just 15 TLDs. As a result, much of the analysis that follows focuses on that relatively small number of TLDs that account for most of the observed activity.<\/p>\n

Ranking TLDs by dropcatch rate, defined as the share of registrations on a TLD that were previously registered rather than net new names, provides an even more focused view of where dropcatch activity is most prevalent. Figure 2 shows how uneven dropcatch activity can be across gTLDs. Particularly striking are .net and .xyz, where nearly three out of every ten newly observed domains had previously existed and were later re-registered. The com TLD, the largest contributor to overall dropcatch volume, was not far behind at 24.5%.<\/p>\n

\"Figure<\/p>\n

Figure 2: gTLDs ordered by dropcatch rate; the rank shown on the Y-axis reflects each gTLD’s contribution to the total volume of re-registered domains across all gTLDs<\/p>\n

While looking at TLDs tells us where drop catching occurs, looking at registrars provides insight into where these domains are ultimately registered. A dropped domain doesn’t simply spring back to life on its own. Someone has to re-register it, and that registration happens through a registrar. That naturally raises the question: which registrars are seeing the most dropcatch activity? Table 1 shows the top 10 registrars with the highest median number of daily re-registered domains observed in 2026. The results reveal a mix of traditional registrars, domain-investor favorites, dedicated dropcatch services, and registrars that also operate expired-domain auction platforms. As we\u2019ll see in the next section, some of these registrars provide tools for identifying, tracking, and acquiring expired domains.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Normalized Registrar<\/th>\nMedian daily dropcatch domains<\/th>\n<\/tr>\n<\/thead>\n
GoDaddy<\/td>\n5246<\/td>\n<\/tr>\n
Namecheap<\/td>\n4385<\/td>\n<\/tr>\n
DropCatch.com<\/td>\n3568<\/td>\n<\/tr>\n
Dynadot<\/td>\n2525<\/td>\n<\/tr>\n
Spaceship<\/td>\n2390<\/td>\n<\/tr>\n
Hostinger Operations<\/td>\n2076<\/td>\n<\/tr>\n
Gname<\/td>\n1679<\/td>\n<\/tr>\n
GMO Internet<\/td>\n1492<\/td>\n<\/tr>\n
Cloudflare<\/td>\n1318<\/td>\n<\/tr>\n
Cosmotown<\/td>\n1074<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 1: Top 10 registrars with the highest median daily re-registered domains<\/p>\n

One question we attempted to answer was what ultimately happens to the roughly 50,000 dropcatch domains we identified. How many of these domains are being acquired by individuals or organizations for active use, and how many are ending up in the hands of domain investors, auction platforms, monetization services, or registrars holding inventory? It turns out that this is another tricky aspect of measuring dropcatch domains.<\/p>\n

To investigate this question, we examined historical WHOIS and DNS data, including registrar transitions, registrant information, nameserver changes, and associations with known parking providers, marketplaces, auction platforms, and dropcatch services. While these data can sometimes identify domains that are clearly parked, monetized, listed for sale, or controlled by known inventory holders, they are often insufficient to reliably determine how a domain is being used or the purpose for which it was acquired.<\/p>\n

Many of the same patterns appear across very different ownership scenarios. For example, a registrar change does not necessarily imply acquisition by an end user; domains may be transferred between registrars, domain investors, auction platforms, or organizations that manage large domain portfolios. Registrant information is also frequently protected through privacy services, making it difficult to determine whether ownership has meaningfully changed. A domain may be acquired by an individual or organization and remain parked for weeks before being put to use, while a domain investor may temporarily configure a domain in ways that resemble ordinary hosting. As a result, distinguishing between domains in active use and those that are simply being held is not always straightforward. Ultimately, answering this question was difficult. Once again, counting is hard!<\/p>\n

Domains can take many different paths before being registered again, whether through a backorder, a registrar-operated auction, or direct registration after release. Understanding those paths requires a closer look at what happens after a particular domain expires.<\/p>\n

How Domains Get Caught<\/h3>\n

While the reasons a domain gets dropped can vary widely, the path a domain takes after expiration is generally more consistent. Although the exact timelines differ across registries and TLDs, most domains follow a similar lifecycle before they can be registered again. The recovery and redemption stages can vary depending on the registry. Most gTLDs follow ICANN’s Expired Registration Recovery Policy<\/strong><\/a>, which provides registrants with opportunities to recover expired domains through an established lifecycle that typically includes a Redemption Grace Period (RGP). Some ccTLDs, however, may have shorter recovery windows or no redemption period at all because their operators are free to define their own lifecycle policies.<\/p>\n

We\u2019ve created a simplified version of the lifecycle followed by many gTLDs, adapted from ICANN’s gTLD lifecycle documentation<\/strong><\/a> in Figure 3.<\/p>\n

\"Figure<\/p>\n

Figure 3. While the exact terminology and timing vary across registries, the general idea remains the same: expired domains often pass through one or more recovery phases before becoming available for registration again<\/p>\n

A domain becoming available for registration does not necessarily mean it will stay available for long. Many organizations and individuals monitor expiring domains and try to register them as soon as they are released by the registry. Some use specialized drop catching services that continuously track domains approaching deletion from the registry and automatically attempt to register them once they become available. As a result, domains can sometimes be re-registered almost immediately after they are released.<\/p>\n

Many users interact with these services through backorders rather than monitoring expiring domains themselves. A backorder allows someone to express interest in a domain before it becomes available. If the service successfully catches the domain, it may be awarded to the customer or, if multiple parties expressed interest, made available through an auction. Figure 4 shows examples of domain auctions and associated bids on DropCatch.com<\/strong><\/a>.<\/p>\n

\"Figure<\/p>\n

Figure 4: Screenshot of a domain auction through drop catching service DropCatch.com<\/p>\n

Not all domain auctions involve domains that have completed the deletion process. Some are auctioned before they are released back to the registry. Several registrars operate their own auction platforms for expiring domains, often providing detailed information about them. Users can browse domains approaching expiration, see how much interest they have attracted, review bidding activity, and filter opportunities based on factors such as age, traffic history, or other signals of potential value. Whether the goal is to find a domain with an established history, recover a forgotten asset, or identify a promising investment, these platforms provide another path for acquiring domains throughout their lifecycle. Figure 5 shows examples of domain listings and bidding activity on GoDaddy Domain Auctions<\/strong><\/a>.<\/p>\n

\"Figure<\/p>\n

Figure 5: Screenshot of expiring domains listed for auction through major registrar GoDaddy<\/p>\n

Who\u2019s Catching…and Why Does it Matter?<\/h3>\n

While we\u2019ll cover a few threat actors using these domains for malicious activities later in this series, not everyone acquiring dropcatch domains has bad intentions. The dropcatch market attracts a broad range of buyers.<\/p>\n

Security researchers, including our own team, deliberately catch expired domains as a defensive measure. For example, domains previously associated with brand impersonation risks can be registered to prevent future abuse. Similarly, when a legitimate domain is accidentally dropped, acquiring it can help ensure that it is recovered safely rather than falling into the hands of a threat actor.<\/p>\n

Domain investors, often referred to as domainers, may acquire domains they expect to appreciate in value for resale or monetization. Older domains may already have established traffic, search engine visibility, or memorable names that make them attractive investments. In some cases, these domains continue receiving visitors long after their original owner has stopped using them because references to them remain scattered across the web. Whatever the intent, the underlying appeal doesn’t change: a domain with a history is often more valuable than a blank slate.<\/p>\n

For threat actors specifically, the inherited reputation isn\u2019t the only thing valuable about acquiring a dropped domain. They also come with a variety of lingering connections: email intended for the original domain holder (see watchTowr Labs\u2019 The Perils of Expired Domains: We’re Reading Your Email)<\/strong><\/a>, cached search results, inherited web traffic, and in some cases, a ready-made platform for code injection on already compromised sites. Lingering DNS records can also create opportunities for threat actors. We previously discussed dangling CNAME attacks in our blog post, Who Knew Domain Hijacking Is So Easy?<\/a>.<\/p>\n

For defenders, this is what turns a dropcatch domain from a registration event into a security concern. Every dropped domain represents a potential transfer of trust from one owner to another, and the security implications don\u2019t necessarily disappear when the original registration expires.<\/p>\n

In one fascinating case, a content distribution network (CDN) domain used by a marketing service expired after the startup was acquired by a larger, publicly traded company. Major media websites embedded URLs and apparently no one noticed when these began failing. The URLs returned no responses for years. That is, until February 2026, when Shady Squirrel, an actor we\u2019ll detail in the third part of this series, snapped it up and began sending website visitors to malware.<\/p>\n

This is just one story of how threat actors use dropcatch domains to further their schemes. We\u2019ll cover many more in the next two parts of this research: Part 2, $7 Million in Expired Domains Fuel a Streaming Empire with a Malware Secret<\/strong><\/a>, where we examine Sable Squirrel, a threat actor that has spent millions of dollars acquiring dropped domains, and Part 3, Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows<\/strong><\/a>, where we explore actors that scavenge expired malicious domains and inherit traffic from previously compromised websites.<\/p>\n