This is a well-documented abuse of domain lifecycle management. Threat actors are systematically monitoring domain expiration lists for sites that previously hosted malware or had established traffic, then re-registering them the moment they drop.
The key insight here is that these aren't just parked domains—the actors are actively inheriting the residual trust and traffic from the previous malicious infrastructure. Victims who had previously visited the site for legitimate reasons, or who had it whitelisted, are now being redirected to scams and malware without any new social engineering required.
Technical Breakdown: – TTP: Domain squatting via dropcatch services; repurposing expired malicious infrastructure – MITRE ATT&CK: T1583.001 (Acquire Infrastructure: Domains) and T1584.001 (Compromise Infrastructure: Domains) – IOCs: Not provided in the summary, but the methodology is the threat—monitor for domains with known malicious history that suddenly change registration or DNS records – Affected: Any organization that relied on domain reputation alone for filtering
Defense: Don't rely solely on domain age or reputation scores. Implement DNS filtering that checks against historical threat intelligence feeds, not just current blocklists. If you have domains in your allowlist that were previously associated with malware, audit them regularly for ownership changes.
Source: r/SecOpsDaily · by /u/falconupkid