Expired Domain Dropcatching: How Attackers Weaponize Your Abandoned Domains for Malware Delivery and C2 — Detection and Defense Guide

A new wave of domain abuse is exploiting something most organizations treat as an administrative afterthought: the expiration of domain names. According to recent reporting based on Infoblox Threat Intel research, approximately 65,000 domain names that previously belonged to someone else are re-registered every single day — a practice known as dropcatching. While much of this activity is legitimate domain speculation, threat actors have industrialized the process, selectively acquiring expired domains specifically to inherit their reputation, residual traffic, and DNS history.

The operational consequences are severe. An expired domain that once belonged to your organization — or a trusted partner, vendor, or government entity — carries implicit trust: it's whitelisted in email filters, embedded in legacy documentation and applications, linked from search results, and remembered by users. When an attacker re-registers that domain, they inherit all of it. Infoblox's first-half-2026 analysis shows these dropcaught domains being deployed for malware delivery, phishing and scam infrastructure, and command-and-control (C2) operations — often bypassing reputation-based security controls that were tuned to trust the domain's history.

If your organization has ever let a domain lapse — a campaign microsite, an acquired company's domain, an old product brand, a regional TLD variant — you need to assume it may now be hostile infrastructure. This post breaks down the threat model, how to detect abuse, and how to build a durable defense.

Technical Analysis

How Dropcatch Abuse Works

Dropcatching itself is a legal, automated practice: registrars and specialized services monitor domain expiration and register names the moment they drop. The malicious variant adds an intelligence layer. Threat actors target expired domains that possess one or more of these attributes:

• Residual inbound traffic — Domains still receiving hits from embedded links in software, documentation, firmware configs, marketing emails, or browser bookmarks. A single expired domain referenced in a widely deployed application's update or telemetry configuration becomes a malware distribution point the moment it's re-registered.
• Email trust inheritance — A re-registered domain can receive password-reset emails, MFA tokens, and account notifications for services still configured with the old domain. Attackers routinely use dropcaught domains to hijack accounts at third-party SaaS platforms where the domain was used for SSO or administrative contact.
• Reputation and allowlist bypass — Secure email gateways, DNS filters, and web proxies often score domains on age and history. A 10-year-old domain with clean history sails through controls that would flag a freshly registered lookalike. Dropcaught domains inherit that age.
• Backlink equity — Domains linked from high-authority sites (news articles, government pages, vendor documentation) become watering-hole or redirect infrastructure for scam and malware campaigns.

The Attack Chain

From a defender's perspective, the typical exploitation sequence looks like this:

1. Acquisition — Actor registers a dropped domain with valuable history (former software vendor, defunct SaaS, expired campaign site, lapsed subdomain parent).
2. Staging — Malicious content is hosted: payload binaries, phishing kits cloned from the original site's branding, or redirect chains to exploit infrastructure. In some campaigns, actors resurrect the original site content from web archives to preserve legitimacy before selectively serving malware.
3. Delivery — Victims arrive via residual links, embedded application callbacks, poisoned search results, or email sent from the inherited domain (which passes SPF/DKIM checks because the attacker now controls DNS).
4. Execution / C2 — Payloads call back to additional dropcaught domains, exploiting their clean reputation to evade egress filtering. Some actors chain multiple inherited domains for redundancy.

Why Traditional Controls Miss This

• Domain age is no longer a trust signal. The domain may be a decade old; the ownership is hours old. Most reputation engines don't track registrant-change events as a risk factor.
• SPF, DKIM, and DMARC validate the domain, not the owner. An attacker controlling DNS for legacy-vendor.com can send fully authenticated phishing email that references real historical relationships.
• Embedded references are invisible to inventory. Hardcoded domains in legacy applications, old installers, partner integrations, and firewall rules rarely appear in any asset register — until they start resolving to attacker infrastructure.

Exploitation Status

This is confirmed, active, in-the-wild abuse at scale — not theoretical. Infoblox Threat Intel tracked dropcaught domains actively serving malware, scams, and C2 infrastructure throughout the first half of 2026. No single CVE applies; this is an infrastructure-trust attack technique that requires no software vulnerability to succeed.

Detection & Response

The highest-value detection strategies target two observables: (1) endpoints and users resolving or connecting to domains on your expired/lapsed asset watchlist, and (2) DNS-layer anomalies consistent with newly re-registered domains serving executable or credential-harvesting content. If your organization doesn't maintain a lapsed-domain watchlist, build one today from registrar records, acquisition history, and marketing/asset inventories — it is the single most effective input for everything below.

Sigma Rules

The first rule detects DNS resolution of domains on your lapsed-asset watchlist (populate the placeholder list with your own expired domains). The second detects executable content being retrieved from rare or uncategorized domains via proxy logs — a common dropcatch malware-delivery pattern.

---
title: DNS Query to Expired or Lapsed Organization Domain
description: Detects DNS resolution of domains that previously belonged to the organization or trusted partners and have since expired. Re-registered (dropcaught) domains are actively used for malware delivery, phishing, and C2 per Infoblox Threat Intel 2026 research. Populate the selection list with your organization's lapsed-domain watchlist.
references:
  - https://securityaffairs.com/197251/uncategorized/crooks-are-buying-your-expired-domains-and-using-them-to-deliver-malware.html
  - https://attack.mitre.org/techniques/T1583/001/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 3f8a2c41-9b7e-4d1a-a6c2-8e5f1b3d9a07
tags:
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: dns
  product: windows
detection:
  selection:
    query:
      - 'legacy-example.com'
      - 'old-campaign-site.net'
      - 'acquired-brand.org'
  condition: selection
falsepositives:
  - DNS lookups from email security or threat intel tools validating the domain
  - Users checking on legacy content before ownership change is known
level: high
---
title: Executable Download from Rare or Uncategorized Domain via Web Proxy
description: Detects retrieval of executable or script content from domains with no established category or reputation in proxy logs. Dropcaught domains frequently serve payload binaries while retaining clean historical reputation scores. Tune the extension and rare-domain fields to your proxy vendor's category field names.
references:
  - https://securityaffairs.com/197251/uncategorized/crooks-are-buying-your-expired-domains-and-using-them-to-deliver-malware.html
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 7c1d9e52-4a3f-48b6-b2d4-6f9a1c5e8b21
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: proxy
detection:
  selection_ext:
    c-uri|endswith:
      - '.exe'
      - '.msi'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.hta'
  selection_cat:
    c-category:
      - 'uncategorized'
      - 'none'
      - 'unknown'
  condition: all of selection_*
falsepositives:
  - Legitimate software vendors hosting installers on uncategorized CDN domains
  - Internal tooling downloaded from new vendor sites
level: medium

KQL — Microsoft Sentinel / Defender

This hunt query identifies endpoint network connections to domains that have extremely low prevalence in your environment — a strong signal for dropcaught C2 or delivery infrastructure — and separately checks your DNS/proxy logs against a lapsed-domain watchlist. Replace the watchlist with your actual expired domains.

// Hunt 1: Connections/resolutions involving organization lapsed-domain watchlist
let LapsedDomains = dynamic(["legacy-example.com", "old-campaign-site.net", "acquired-brand.org"]);
let WatchlistHits = union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (LapsedDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType),
    (DnsEvents
    | where TimeGenerated > ago(14d)
    | where Name has_any (LapsedDomains)
    | project TimeGenerated, ClientIP, Name, IPAddresses);
WatchlistHits
| sort by TimeGenerated desc;

// Hunt 2: Low-prevalence outbound connections — candidate dropcatch C2/delivery domains
let Lookback = 30d;
let Baseline = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback) and TimeGenerated < ago(7d)
    | where isnotempty(RemoteUrl)
    | summarize HistCount = count() by RemoteUrl
    | where HistCount < 5;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where isnotempty(RemoteUrl)
| where RemoteUrl in (Baseline | project RemoteUrl)
| where InitiatingProcessFileName !in~ ("msedge.exe", "chrome.exe", "svchost.exe", "firefox.exe")
| summarize Connections = count(), Devices = dcount(DeviceId),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    ProcessList = make_set(InitiatingProcessFileName, 10)
    by RemoteUrl, RemoteIP
| where Connections > 3
| sort by Connections desc

Velociraptor VQL

This artifact hunts endpoint DNS caches and active connections for resolutions of watchlisted lapsed domains — useful for scoping exposure across a fleet when you discover a former asset has been dropcaught.

-- Hunt for endpoint DNS cache entries and connections matching lapsed-domain watchlist
LET Watchlist <= ['legacy-example.com', 'old-campaign-site.net', 'acquired-brand.org']

SELECT * FROM foreach(row=Watchlist,
query={
    SELECT
        Fqdn AS WatchedDomain,
        Name AS CacheEntry,
        Data AS ResolvedData,
        Type AS RecordType
    FROM Artifact.Windows.System.DNSCache()
    WHERE CacheEntry =~ WatchedDomain
})
UNION ALL
SELECT * FROM foreach(row=Watchlist,
query={
    SELECT
        Fqdn AS WatchedDomain,
        Name AS ProcessName,
        Pid,
        Raddr.IP AS RemoteIP,
        Raddr.Port AS RemotePort,
        Status
    FROM netstat()
    WHERE Raddr.IP =~ '.'
})

Verification & Hardening Script

Use this PowerShell script to check endpoints and local DNS caches for resolution of your lapsed-domain watchlist, and to validate whether expired domains you once controlled now resolve to unfamiliar infrastructure.

# Expired-Domain Exposure Audit — Security Arsenal
# Populate with domains your organization previously owned or referenced
$watchlist = @("legacy-example.com","old-campaign-site.net","acquired-brand.org")

# 1. Check local DNS cache for watchlist hits
Write-Host "[+] Checking local DNS cache for lapsed-domain resolutions..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object {
    $entry = $_.Entry
    $watchlist | Where-Object { $entry -like "*$_*" }
} | Format-Table Entry, RecordType, Data -AutoSize

# 2. Resolve each watchlist domain and flag current ownership infrastructure
Write-Host "`n[+] Resolving watchlist domains to identify current hosting..." -ForegroundColor Cyan
foreach ($domain in $watchlist) {
    try {
        $res = Resolve-DnsName -Name $domain -ErrorAction Stop
        $res | ForEach-Object {
            Write-Host ("{0,-35} -> {1}" -f $domain, ($_.IPAddress, $_.NameHost -join ' ')) -ForegroundColor Yellow
        }
    } catch {
        Write-Host "$domain does not currently resolve (NXDOMAIN)" -ForegroundColor Green
    }
}

# 3. Export results for SIEM ingestion / IR scoping
$report = foreach ($domain in $watchlist) {
    try {
        Resolve-DnsName -Name $domain -ErrorAction Stop | Select-Object @{N='WatchedDomain';E={$domain}}, Name, Type, IPAddress, NameHost
    } catch { $null }
}
$report | Export-Csv -Path ".\expired_domain_audit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "`n[+] Report exported. Investigate any domain resolving to unknown infrastructure." -ForegroundColor Cyan

Remediation

There is no patch for inherited trust — defense here is programmatic. Prioritize the following:

Immediate (0–7 days)

1. Build the lapsed-domain inventory. Pull registrar account history, acquisition/M&A records, and marketing archives. Identify every domain your organization ever owned or operated, its expiration date, and its current registration status. Re-register or defensively acquire any that have dropped and still carry your brand.
2. Audit embedded references. Search codebases, installer packages, firmware configs, GPOs, firewall rules, email templates, and documentation for hardcoded legacy domains. Any reference to a domain you no longer control is a live supply-chain risk — remove or redirect it.
3. Block at the resolver. Add dropcaught former assets to your protective DNS blocklist (or sinkhole them) and alert on any internal resolution attempts — a resolution attempt means something in your environment still trusts that domain.
4. Rotate exposed credentials. If a lapsed domain was used for email at any SaaS, IdP, or registrar, assume account-recovery flows are compromised. Rotate admin contacts, reset credentials, and audit SSO configurations.

Strategic (30–90 days)

5. Adopt a no-expire policy. Auto-renew all domains, including defensive registrations and dormant campaign sites. The annual registration cost is trivially small against the cost of an IR engagement. If a domain must be retired, maintain registration but null-route it — ownership retention is the control, not content.
6. Monitor registrant-change events. Use domain-monitoring services (or feeds from providers like Infoblox) that flag when domains of interest change hands. Alert on WHOIS/registrant changes for your brand terms, former assets, and key third-party vendors.
7. Deprecate domain-age trust in your stack. Work with your SEG, DNS filter, and proxy vendors to ensure reputation scoring accounts for ownership-change signals, not just registration age. Add newly-re-registered-domain categories to block policies where available.
8. Exercise the scenario. Add "attacker re-registers our expired domain" to your tabletop rotation. Test whether your SOC can detect authenticated phishing from a legitimately-SPF/DKIM-valid former domain, and whether IR can scope embedded application callbacks to hostile infrastructure.

References

• Infoblox Threat Intel — dropcatch domain research (first half 2026), as reported at the source URL below
• MITRE ATT&CK: T1583.001 — Acquire Infrastructure: Domains
• MITRE ATT&CK: T1071.001 — Application Layer Protocol: Web
• Source: https://securityaffairs.com/197251/uncategorized/crooks-are-buying-your-expired-domains-and-using-them-to-deliver-malware.html

The uncomfortable truth is that your attack surface includes assets you stopped paying for years ago. Every domain your organization has ever touched is a standing delegation of trust — and if you abandon it, someone else will pick it up. Treat domain lifecycle management as a security control, not an administrative task.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub