Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available for registration and is then snapped up by another party. During the first half of 2026, 50,400

The article reports that threat actors are buying expired domains to inherit existing traffic and reputation, then redirecting victims to scams and malware. This is a general cybercrime campaign and does not describe a direct AI system compromise, but it is relevant to AI security when organizations rely on automated link ingestion, reputation signals, or agentic browsing that could be steered toward malicious destinations. RealGround analysis: defenders should treat expired-domain abuse as a supply-path and trust-boundary risk, especially for AI agents that fetch external content or follow web links without strong destination verification.