How do expired domains help hackers avoid detection?
Security researchers warn that cybercriminals are investing heavily in expired web domains to launch malware campaigns, exploiting the trust and authority these domains once held. Roughly 65,000 expired domains change hands daily on the open market, creating a vast pool of opportunities for attackers seeking to bypass security filters. One criminal group has been observed spending millions of dollars each month acquiring these domains to host phishing pages and distribute malicious software. By purchasing domains that previously belonged to legitimate businesses or organizations, hackers can leverage their residual reputation in search engine rankings and email trust systems. This tactic allows them to evade detection by security tools that rely on domain age and history as indicators of legitimacy. The practice has become a significant threat vector, particularly for users who assume older websites are inherently safer.
Breaking news
Judge Questions Fairness of Google's AI Overviews in Antitrust Case
Apple's iPhone Event Tagline Varies by Country Ahead of September Launch
Gemini 3.5 Transcribe Eliminates Filler Words From Speech
Google addresses Keep list addition issues with potential fixInfoblox Threat Intelligence researchers identified a specific operation where attackers used expired domains to mimic trusted brands, tricking users into downloading ransomware or revealing sensitive information. The low cost of acquiring these domains — often under $10 each — combined with high returns from successful scams, makes the strategy highly attractive to cybercriminal networks. As domain registration and expiration continue at massive scale, experts say the problem is likely to grow without improved monitoring and faster takedown mechanisms.
Expired domains often retain positive signals in security databases, such as clean historical records and established backlinks, which can fool automated scanners. Criminals exploit this by using these domains shortly after purchase, before reputation systems update to reflect malicious activity. This window of opportunity allows malware to spread undetected for hours or even days. Security tools that rely heavily on domain age as a trust factor are particularly vulnerable to this tactic. Researchers note that some attackers time their campaigns to coincide with search engine reindexing cycles, maximizing visibility before flags are raised.
What can be done to stop this abuse of expired domains?
Experts call for closer collaboration between domain registrars, security firms, and internet governance bodies to improve real-time monitoring of newly registered expired domains. Implementing faster reputation decay mechanisms and sharing threat intelligence across networks could reduce the window attackers currently exploit. Registrars could also impose stricter verification steps before allowing rapid changes to domain ownership or DNS settings. Until systemic changes are made, users are advised to remain cautious when visiting unfamiliar websites, even if they appear established or have been online for years. The underlying issue highlights a gap in how digital trust is assessed — one that cybercriminals are increasingly adept at manipulating. Frequently Asked Questions How many expired domains are available for purchase each day? Approximately 65,000 expired domains become available for purchase daily on various domain marketplaces and auction platforms.
Why do hackers prefer expired domains over newly registered ones? Expired domains often have existing trust signals, such as age, backlinks, and clean historical records, which help them bypass security filters that flag new or suspicious domains.
Can antivirus software protect users from threats hosted on expired domains? While antivirus tools can detect known malware, they may not block access to malicious sites relying on expired domains if the domain itself is not yet marked as harmful in threat databases.