Preventing Zombie Domains: Why Expired Domains Are a Serious Security Risk—and What Brands Can Do to Protect Themselves

As experts in enterprise domain portfolio management, we have seen the following scenario happen too often. A brand lets a domain registration lapse, and almost instantaneously a specialized drop‑catch service is used to register it, then it quickly gets repurposed to take advantage of the trust your brand has spent years building. Bad actors can use expired and ideally, previously used, domain names to impersonate brands, intercept email, and leverage established search authority to capture traffic, personal information, and financial data. Oftentimes, it takes organizations a long time to discover the abuse, especially if they don’t have proactive domain or brand monitoring in place.

This is not hypothetical. WIPO recorded a record number of domain disputes in 2025 (6000+ cases), underscoring how aggressively cybersquatters and fraud actors pursue expiring brand domains. What’s more, Artificial Intelligence is accelerating and raising the stakes significantly. AI Large Language Models are being used to analyze and identify the potential of expiring domains, capture them faster by identifying when they will drop to the millisecond, as well as create and launch functional, quality looking brand imposter websites in record time.

If it sounds unnerving, it’s because it is. The longstanding battle to capture expiring brand domains is being supercharged by AI. Let’s unpack and better understand the risk to organizations, and how the team and tools at Webnames Corporate can help you prevent it.

Understanding How Expired Domains Become Brand Liabilities

Ideally, every organization should have a clear and intentional domain management policy that addresses how it handles domain name renewals and expiry; however, even when policies are being adhered to, lapses can still occur due to streamlining decisions, time outs during transfers, missed domains in a portfolio consolidation, or the retirement of  sub-brands during mergers or downsizing.

Domain Expiry Phases and Drop Catching

When a domain name isn’t renewed, it passes through a series of phases called the Grace Period, Redemption Period, and Pending Delete Period. Registries (like CIRA for .CA and Verisign for .COM) publish daily lists of domains entering the “Pending Delete” phase. This is essentially a public schedule of exactly when a domain will become available

Seasoned “drop-catchers” are typically domain name speculators, professional marketers, Internet opportunists and, unfortunately, fraudsters. First, they leverage bots to filter and assess expiring domains for valuable traits, then they attempt to register them via automated systems. These players will compete to capture a domain name at the literal millisecond it drops for the following reasons:

• Inherent value of a domain name because of its prior usage and age, SEO history, backlinks, and residual traffic
• Reselling at premium prices
• Brand protection or defensive measure to keep it out of the hands of competitors of bad actors (typically applies to companies trying to secure domains related to their own brands, including typos and other problematic impostor domains)

The process is extremely competitive, with numerous drop catch services and registrars vying for the same expiring domain name. The moment it drops, thousands of requests are sent to capture the domain.

What it the Threat this Poses for Brands?

Brand domain names, and especially those that have seen prior use either on the web or internal operations, are particularly valuable and therefore vulnerable to exploitation.  After they are secured using a drop-catching service they can be used for a wide variety of domain-based attacks, and with AI, the attacks are continuously evolving in terms of both speed and complexity.

Email Catch-All Hijacking via MX Record: Probably the most critical risk. Attackers set up a server to receive email sent to any address at that domain. They then can use these emails to trigger password resets for corporate accounts (SaaS tools, banking, or social media) that may have never been transitioned to a new address, a threat known as Account Takeovers. They can also gain intelligence from incoming emails about vendors and attempt Business Emila Compromise attacks, sending invoices, payment links and other fraud tactics.

Brand Mirroring and Credential Harvesting: Using AI-driven scraping, fraudsters can now create near perfect replicas of your old websites and impersonate brands or government bodies with greater efficiency and accuracy. Customers or clients who have your website bookmarked or see it in marketing materials land on an impostor website designed to steal their credentials or credit card info. To a patient, a student, or a citizen, the When the user attempts to “login,” their credentials are stolen.

The “SEO Parasite \” Content : Attackers use your domain’s high search engine authority to host illegal gambling, crypto scams, or malware. Because it’s a “trusted” Canadian domain, Google may rank these malicious pages at the top of search results.

As you may have gathered, the threat is much greater than a loss of traffic or someone reusing your domain. Depending on the history of your domain, you could be handing over keys to assuming your digital identity.

Institutions and Brands Are Both Targets, Including in Canada

The Canadian populations higher trust in domestic institutions, generally safer Internet, and its secure top-level country code domain, .CA, makes Canadian brands and organizations attractive targets.

In 2025 and into 2026, researchers tracked an expansive Pay Tool phishing ecosystem targeting Canadians by using a combination of more than 70 expired and typosquatted domains to simulate provincial payment portals where people go to pay fines like traffic tickets. The scam harvested personal identifiable information (PII) and credentials at scale, using phony payment gateways to capture credit cards info and Interac e-Transfer logins.

The hugely attended Toronto Christmas Market became another classic example of legacy domain hijacking a couple years ago when it allowed a domain name for one of its marquee events expire. Scammers quickly snatched up the expired domain and created a pixel-perfect clone of the original site that redirected users to illegal gambling platforms and phishing sites designed to harvest credit their card data under the guise of ticket sales.

As Canadians increasingly rely on digital services for taxation, parcel delivery, healthcare services, travel and more, threat actors are racing to exploit this dependency by creating convincing impersonation campaigns that utilize expired or lookalike domain names to mimic trusted government bodies and national brands.

Recovering a Lost Domain is Slow, Costly, and Will Not Undo Brand Damage.

Once a third party captures your domain name, your choices become limited to attempting to buy it back from the registrant using a domain name broker, or if you own the trademark, undergoing arbitration via the Uniform Domain-Name Dispute-Resolution Policy (UDRP) for .COM, .ORG, .NET or, in the case of .CA, the CIRA Domain Name Dispute Resolution Policy (CDRP).

The goal of both policies is to provide a faster, cheaper alternative to formal legal action for trademark owners to reclaim domains from cybersquatters and not have to go to court. To win, you must prove three things:

• The domain is identical or confusingly similar to your trademark.
• The new owner has no legitimate rights or interests in the name.
• The domain was registered and is being used in bad faith (eg., trying to sell it back to you for an exorbitant price, diverting your customers, or another misleading and/or fraudulent use).

In the case of the CDRP, Canadian Presence Requirements also need to be met, and trademark rights must have existed before the domain was registered by the disputed holder.

It’s important to understand, however, that a successful domain name recovery will not erase blacklists, search engine penalties caused by abuse, or other domain red flags that the domain acquired while it was out of your management, in addition to the hard work of repairing trust and reputational damage to your brand.  

Preventing the Expired Domain Problem – A Detailed Roadmap

At Webnames Corporate, we treat domain names like the business-critical assets they are, and believe that the systems protecting them must be as resilient and professionally managed as the brands and governments who rely on them. Protecting an organization from the risks of expired or dropped domains is most effective when addressed within an overarching domain portfolio security strategy that includes internal management and access policies, management of technical settings, utilizing proactive security features the registrar level, as well as brand domain blocking services.

Below is a roadmap for implementing a powerful security posture across your domain portfolio that will protect your domains across many fronts, including from accidental expirty.

Choose a Security‑First, Corporate Domain Registrar

Most registrars are built for retail end users, not enterprises, large organizations or government with compliance, operational and security requirements, not large portfolios of 100 to 10,000+ domain names that can include a mix of ccTLDs and TLDs with specialized requirements.

Webnames Corporate has specialized in enterprise‑grade domain security, portfolio management, and brand protection for more than twenty years. Our platform, processes, account management model, and centralized billing with invoicing have been designed specifically to support the needs of large domain name portfolios, and our experienced team understands the needs of these clients.  

Corporate domain registrars are fewer in number, and while many offer similar core services and security capabilities, pricing models and total cost of ownership can vary significantly. When evaluating providers, seek transparency in how costs are structured, specifically what is included by default, what incurs additional fees, and whether change or update fees apply. It’s also critical to confirm whether personalized support is provided, ideally through a dedicated Account Manager, and to ask about the registrar’s service standards. Taking the time to compare these factors upfront can help organizations avoid hidden costs, reduce operational friction, and choose the best domain management partner for both their needs and organization.

Consolidate and Audit your Domain Name Portfolio

When business domains are spread across multiple providers and registrants, they become harder to track, easier to forget, and more vulnerable to expiry, misconfiguration, or abuse. When we begin working with a new client, we always undertake an audit of their domain footprint and often identify “at risk” assets such as legacy microsite domains, deprecated promo domains, redirected domains and others.

Fragmented domains of these kinds are highly vulnerable, often leading to missed renewals, lack of proper security settings, and increased exposure to attackers.  Consolidating a portfolio with a enterprise focused registrar like Webnames Corporate single provider enhances brand security by reducing threat surfaces (accounts, logins, passwords), harmonizing ownership and registration data, as well as facilitating a rapid response in the face of threats, underpinning more advanced protections.

Implement Internal Policies and Safeguards

After your portfolio has been consolidated and audited, with every microsite, promo URL, and legacy domain your organization identified, the next step is to organize your domain names according to importance and risk.

Let’s be clear, when you have dozens, hundreds or thousands of domain names, some are more consequential than others. Not every domain name needs “the works”.  Organizing your portfolio into tiers allows you to spend your budget where it matters most while still ensuring every domain is protected.

Domain Tiering Methodology

When it comes to organizing your domain name portfolio, importance and risk are the leading criteria. Here is a helpful methodology for getting your domain house in order.

Tier 1: Mission Critical and High Importance – (e.g., brand.com, brandapi.com). These are the Mission Critical domains that handle your primary traffic, ecommerce, email, and internal apps. Other important domains include anything that covers your trademarks, product names, public relations, names of leadership, etc.

Tier 2: Defensive Registrations and Regional Brands – (e.g., mispelledbrand.com , brand.co.uk). These domains protect your brand name regionally, protect your brand in higher risk TLDs, capture misspellings and typos, etc.

Tier 3: Retired/Legacy – (e.g., sunsetbrand.com, oldproduct.com). These domains no longer see active use and represent discontinued products, services, or initiatives; however, they might still have SEO value or could potentially be used for phishing or fraud if lost.

Implementing No-Expiry Safeguards and Sunsetting Domains Properly

Given that domain names cannot be owned in perpetuity, so there’s always a degree of risk that they can expire permanently. There are features, registrar services and “No Expiry” management approaches that organizations can implement to safeguard from accidental expiry and ensure that core domain remain securely registered for the longterm.   

A successful no-expiry or never delete strategy  

• Multi‑year renewals  – having domain names registered for 2, 5 or 10 years at a time
• Auto‑renew – having auto-renewal functionality enabled on domain names
• Expiry Protection – a failsafe service layered on top of auto-renewal, expiry protection should be used for brand domains and any domain name that has seen active use

Approaches to Sunsetting Domain Names

Below are two proven approaches for important brand assets and any domain name used for a customer facing website, business email and API traffic:

Option A -10 Year Registration Rule

• For, the policy is to renew for the maximum allowable period (usually 10 years) and set to Auto-Renew.

Option B – 10-Year Rolling Registration Rule

• Maintain a minimum of 5 years of remaining registration at all times
• Every year, renew the domain for one additional year. This creates a 5-to-10-year buffer. Even if a payment is missed for four straight years, the domain remains registered.

Don’t Skip Expiry Protection on Core Domain Names

The purpose of Expiry Protection is to prevent accidental domain loss when a renewal fails due to human error, administrative lapses, or payment problems such as an expired credit card at the time of renewal – all of which are more common than most organizations realize. It’s designed to hold ownership in place for the registrant and prevent deletion.

While expiry protection buys time to course correct any issues, it’s important to note that it does not hold that domain’s active services in place. This means that corresponding website, DNS, email and app services may stop functioning after the domain’s 30‑day grace period.

Below is a list of what brands should consideras “core” domain names when applying expiry protection:

Non-negotiable:

• Primary brand domain (e.g., company.com)
• Domains used for core websites
• Domains used for business email
• Login or customer‑facing portals
• Brand and trademark domains

Losing any of the above can lead to catastrophic business impacts.

Strongly recommend:

• Company name variants
• Product names
• Executive names

Losing these can result in impersonation or cybersquatting.

Recommend:

• Long‑held but no longer in-use domain names

These are valued by bad actors for their SEO authority, backlinks and accumulated trust.

Net 30 Invoicing Protects from Credit Card Failure

In addition to multi-year registrations, Webnames Corporate Net-30 invoicing provides another barrier to expiry.  In the event a payment fails, an account manager will reach out to your Administrative Contact, Accounts Payable or Legal Department to follow-up on the payment instead of an automated system potentially letting a domain lapse because of credit card failure.

Sunsetting Corporate Domain Names

Not all domain names are meant be kept indefinitely. A domain management strategy also needs to address how to prune a portfolio in a brand’s best interest.  Properly sunsetting domain names is an important piece of any cybersecurity strategy, helping to mitigate opportunities for brand abuse, reputational damage, email and account hacking.

When it comes time to determine if a domain name is a good candidate to lapse, consider the following criteria:

• Domains that no longer align with your business models, products, or brand identity
• Longtail TLDs or ccTLDs that are being kept as protective registrations
• Domains associated with websites where the cost of maintenance and/or carrying of technical debt outweighs the security benefit

Once you have identified the domain names you want to let go of, best practice recommends auditing for backlinks, doing email checks and implementing 301 redirects to drain legacy traffic without exposing your organization to impersonation risks. Recommendations for how long to leave 301 redirects in place can vary, but a minimum of one year is advisable.

With the above in mind, we recommend running the following steps:

Remember, when in doubt, data is the most objective way to judge a domain name’s value to your brand and potential bad actors before deciding to let its registration lapse.

Part Two: From Reactive Cleanup to Staying Ahead of Domain Threats with Proactive Protection

Even the best renewal policy can’t protect you from what you can’t see, including the potential of domain changes made too quickly, in accounts where too many people have access. That’s why mature domain security programs layer visibility, prevention, access control and change controlon top of renewal safeguards.

The goal is simple: reduce the odds of domain loss and shrink the opportunity for bad actors to weaponize your name.

Continuous Monitoring for Lookalikes and Abuse

The truth is you can never register every risky variant of your brand and you shouldn’t try to. With thousands of active TLDs, the number of combinations is astronomical and budgets shouldn’t be spent on an endless defensive registration game. Instead, modern brand protection requires monitoring, because monitoring can often warn you even before a fraudulent domain is operational, indexed, or used for an phishing campaign or spoofed website.

Domain Monitoring is one of the most cost‑effective controls you can deploy. You choose the terms that matter (core brand, product names, c-suite and leadership names, “support/login/billing”), and you get alerted when new registrations appear. Webnames Domain Monitoring supports ongoing monitoring (daily reporting), as well as inexpensive one‑time searches for investigations or brand research.

A few reasons why monitoring is so important to your business operations:

• Speed -Monitoring detects new registrations across a large domain dataset and can report on newly registered domains containing your marks or keywords, helping teams respond before the domain gains traction.
• You don’t need to register everything to be protected -Monitoring lets you focus on high‑risk strings and investigate only what’s actionable, rather than carrying hundreds of low‑value defensive domains indefinitely.
• It supports both security and legal – Reports can provide useful context (e.g., results lists and associated domain intelligence) to support responses, enforcement, or escalation without waiting for customer complaints to surface the issue and trust in your brand being chipped away.

How We Recommend Organizations to Use Monitoring

Start with a list of your most important marks, brands and “attack‑surface” keywords (e.g., support, login, verify, billing, invoice, helpdesk). Then expand to cover key product names, campaigns, and executive names as needed. Remember, monitoring doesn’t replace defensive domain name registrations, rather, it ensures you’re not blind outside your owned portfolio.

Domain Blocking Programs: Proactive Trademark and Brand Protection at Scale

While domain monitoring tells you what’s happening, domain blocking programs work behind the sciences to prevent a wide range of potential problems from happening at all by allowing verified rights holders to make their marks unavailable for third‑party registration.

The domain name expansion that occurred between 2014 and 2024 saw over a thousand new Top-Level Domains come to market, creating a huge opportunity for bad actors. It left hundreds of inexpensive nTLD (new Top-Level Domains) options on the table for opportunists to register for scams, monetization and resale. Domain blocking programs came about to offset the inefficiency and expense of needing to defensively register trademarks and other important brand domains across the huge selection of extensions, as well as a selection that were perceived to pose a reputational risk to brands (e.g. .xxx, .porn, .sucks, etc.).

DPML, AbuseShield, AdultBlock and the more recent GlobalBlock, effectively block registrations matching registered trademarks, unregistered trademarks, company/organization names, and even names of public figures from occurring across hundreds of domain extensions and multiple domain registries.

Why blocking has become the leading option for protecting brands in the domain space:

• Domain blocking scales across hundreds of TLDs at once, dramatically reducing the administrative burden of renewals, redirects, and record‑keeping.
• It’s cost‑effective compared to broad defensive registration strategies and reduces downstream costs tied to enforcement, dispute actions, and aftermarket acquisitions.
• It dramatically reduces bad actor and attack options by removing easy wins in niche, easily accessible, often inexpensive extensions exactly where phishing and impersonation campaigns often start.

GlobalBlock – The Closest Solution to Universal Domain Blocking

The 2024 launch and ongoing expansion of GlobalBlock ushered in a new benchmark for proactive marks protection in domain names. The newest and broadest of the programs, its unified blocking service covers 750+ domain extensions – including major gTLDs and high-value country codes like .cn (China) and .de (Germany) – under a single subscription. The service isn’t only for registered trademarks, it also applies to unregistered trademarks (with proof of use), company or organization names, as well as names of celebrities/public figures with legal documentation.  Where cybersecurity risk and regulatory compliance is concerned, GlobalBlock represents a strategic shift from buying domains to neutralizing a swathe of the perimeter.

GlobalBlock doesn’t simply function as a reserved-list blocking names from being registered at the registry level; rather, it functions more like a sophisticated shield providing new benefits that redefine how organizations handle domain risk, including:

• Enhanced Coverage for Complex Variants – While the standard service blocks exact matches, the “Plus” version extends protection to the front lines of the phishing war. It covers an unlimited number of homoglyphs and Unicode variants (e.g., replacing ‘o’ with ‘0’ or using a Cyrillic ‘а’ instead of a Latin ‘a’). These visually identical characters are the primary tools used in modern credential-harvesting attacks, and GlobalBlock+ shuts them down before they can be registered.
• Priority AutoCatch at Expiry – If a third party already owns a domain that matches your trademark, GlobalBlock doesn’t give up. Through Priority AutoCatch, the system continuously monitors those domains and automatically secures them into your block the literal millisecond they expire. This happens in the background, without additional brokerage fees or manual intervention.
• Simplified, Efficient Management: Organizations can finally pare down domain name portfolios that grew unruly from holding onto hundreds of defensive renewals. A single GlobalBlock subscription replaces the need for ongoing monitoring and manual management of vast defensive portfolios, freeing your IT and legal teams to focus on higher-value initiatives.
• Flexibility in Domain Use (Unblocking): One of the coolest powerful is that a block is not a permanent end or fixed state. If your brand decides to launch a legitimate marketing campaign on a previously blocked extension, you can easily unblock and convert that name into a live registration. This allows you to treat your blocks as  reserved assets that can be leveraged whenever your brand strategy requires.

A Strategic Investment in Prevention

Choosing GlobalBlock is more than a security move – it is a financial one. When you weigh the total cost of ownership, taking into account registration fees, administrative time, and the potential legal costs of reclaiming a hijacked domain, blocking emerges the as arguably the most cost-efficient way to protect brands in the domain space.

By providing prevention and strategic flexibility, GlobalBlock ensures that your security posture grows lockstep with your brand footprint, providing a very simple and direct way to stay one step ahead in fast evolving, AI-driven threat environment.

Domain Locks: A Critical Control Point for Domain Security

With monitoring serving as your security camera and blocking as the perimeter fence, account and domain name locks serve as the deadbolts to your front doors. Locks can be a big threat mitigator of the Zombie Domain problem, ensuring that your mission-critical domain names cannot be moved, changed, or deleted without rigorous, multi-factor authorization.

For the domains that anchor your corporate identity – specifically your website, email, and APIs – we recommend a layered locking strategy. This isn’t just a domain name management best practice, it’s also a necessary checkmark in meeting internal security and compliance requirements such as SOC2 or ISO 2700. Unlike registry lock which is standardized by the registry operator (the organization that manages top-level domains such as .ca or .com) and requires an additional out of band verification step between both registry (e.g. CIRA) and the registrar (e.g., Webnames Corporate or Webnames.ca), registrar locks can vary considerably in terms of the protection they provide and verification procedures. required to access the domain name, therefore it is vital to understand exactly what you’re getting with your registrar and how it works to ensure it meets enterprise standards and/or compliance requirements.

Domain Security Lock Comparison

The Way Forward: Smarter, Proactive Defense for Corporate Domain Portfolios

The best domain security posture today, given the rapid evolution of both technology and cyber threats, is one that is one step ahead of developing threats. The team at Webnames Corporate is passionate about helping organizations employ a smarter mix of domain management practices with proactive security features to keep brand domains secure from lapsed renewals and the Zombie Domain risk, as well as having your brand appropriated in domain form for cybersquatting, typosquatting, phishing and malware distribution, and other scams capable of causing reputational and financial harm.  

If you are ready to create forward momentum in the protection of your domain names, you can review and act on our Domain Protection Mini Playbook below.

Domain Protection Take Aways: Mini Best Practice Playbook

Ready to Experience Better Domain Management?

Don’t wait for a painful domain management misstep to get your corporate domain portfolio in compliance. Our domain management experts can help your organization rightsize, organize and implement a proactive, cost-effective domain protection plan whenever you are ready to begin.

Schedule a call with us at your convenience to learn more about how we can transform your domain management for the better. Let us handle the complexity of your domain security, so you can focus on what you do best.