Solving the security threat of dropped domains

As a web developer, you might be tasked with setting up a temporary website for a company event. But when the website’s no longer needed, what happens if you lose track of the domain?

If a company somehow misses the warning emails to renew, the domain will be rereleased to the public, where anyone can register it—opening the door to “dropcatch attacks,” or malicious actors who use the domain to redirect users to scams and malware.

In a blog post, IT automation and cybersecurity company Infoblox reported that it had observed more than 50,000 dropcatched domains (i.e., a domain name expiring, becoming available to the public, and someone securing it) per day among generic top-level domains—that is, .com, .org, .net, .biz, and .info—in the first half of 2026.

While not all of those dropcatches were necessarily linked to attacks, it shows the scope of the potential problem when businesses shut down, miss renewal notices, or forget email accounts tied to web addresses.

How’d you drop that? Renée Burton, Infloblox’s VP of threat intel, told IT Brew that the best way for enterprises to maintain domain security is through policy and processes. For example, that could mean ensuring an employee can’t use a company’s brand name as part of a domain registration without going through a centralized group or the IT department.

“It’s really a process and policy issue,” Burton said. “In the end, so many ways that things can go wrong, so you need to be able to say, ‘I have a centralized location.’”

Along with process and policy, Burton suggested that IT professionals should employ monitoring tools to detect website impersonators who might use content like corporate logos and brand signals to fool users into thinking a website is legitimate.

Luigi Lenguito, the founder of cybersecurity firm BforeAI, told IT Brew that without strong governance, employees or third party-vendors could spin up domains without plans for proper takedowns.

How to pick up dropped domains. Bigger corporations are largely protected from dropcatch-style attacks because they have resources to aid governance, including procedures and tooling, while medium-size organizations do not: “Domain maintenance is quite an intense activity; it does require governance, it does require tooling for visibility.”

Lenguito added that while the first step that organizations at risk can take is to preemptively avoid attacks through governance and visibility efforts, organizations can also look to use external attack surface tools to find and disrupt impersonation domains as they go up to protect customers.

“What the end result is is that proper domain is not accessible anymore and in much less time than if you’re doing just [a] takedown,” Lenguito said. “But you’re basically getting out of the internet.”