Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actors have spent nearly $7 million acquiring expired domains in order to redirect traffic to scams and malware. These domains, referred to as dropcatch domains by DNS threat intelligence firm Infoblox, are expired domains that become available for registration and are quickly acquired by another party. This tactic allows hackers to inherit the traffic and reputation of the original website. In the first half of 2026, a significant number of these dropcatch domains were acquired, with 50,400 being purchased. This method is being used on a large scale to redirect victims to malicious content. The acquired domains are used to scam users or distribute malware.