Drop Something? Don’t Worry, Someone Caught it

This is a classic case of domain re-registration risk, and it’s a blind spot for a lot of teams.

The core issue is that an expired domain doesn’t just vanish—it enters a dropcatch cycle where anyone (including threat actors) can pick it up. The new owner inherits any residual trust from the domain’s history, like existing email flows, whitelisted SPF/DKIM records, or embedded links in old documents.

Technical Breakdown: – TTP: This is a supply chain / trust exploitation play. Attackers aren't breaking in; they're buying the keys to the front door. – MITRE Mapping: T1584.001 (Compromise Infrastructure: Domains) and T1583.001 (Acquire Infrastructure: Domains). The post-registration phase often leads to T1566.002 (Spearphishing Link). – IOCs: None provided in this summary, but the hunting ground is clear: any domain in your logs that has a registration date after its last known legitimate activity. Look for domains with a "Created Date" that is newer than the "Last Seen" date in your proxy logs.

Defense: – Proactive: Monitor your own expired domains. If you let one lapse, assume it will be caught. Implement domain expiration alerts and a strict renewal policy. – Detection: Query your DNS logs for domains registered within the last 30-90 days that are communicating with internal systems. Cross-reference with passive DNS for historical ownership changes. If a domain was registered 10 years ago but was re-registered last week, that’s a high-fidelity alert.

Source: https://www.infoblox.com/blog/threat-intelligence/drop-something-dont-worry-someone-caught-it/