The average time between when a valuable domain becomes available and when an automated domain harvesting system registers it for themselves is 144 milliseconds. We know this because UpGuard researchers discovered an exposed Elasticsearch server with logs from one of these systems that detected newly expired domains, judged their relative value using AI and attempted to register them before anyone else could. For defenders, this means there is no room for error in maintaining domain registration. In less than a second, it will be gone. 

The domain lifecycle requires that registrations be actively renewed. If this renewal fails, the domain becomes available to the public for purchase. For primary domains, this is rarely a problem, as these assets are closely guarded and constantly in use. However, secondary or tertiary domains can easily fall by the wayside and when they do, they are ripe for the taking by fraudulent actors looking to impersonate the associated organization.

Data Analysis

The publicly exposed server contained six indices: three months of application event logs for the catching engine (domain-logs, ~4.17M docs) and three per-request logs of registration attempts (registrar-requests, ~580K docs). Together they provide a complete, timestamped operations record of an automated squatting operation over ten weeks.

The Domain Squatting Pipeline

The whole operation consists of a six stage pipeline: harvest, score, watch, detect, attack and reconcile.

For all that, only a very small number are actually captured. Competition is stiff for valuable domains.

TLD Breakdown

The target mix shows what these operations prize: high-trust legacy TLDs and the current speculative gold rush. Roughly a third of all activity targeted .com domains. However, the .ai TLD alone drew 658K events, illustrating the AI-domain land grab in real time.

What It Caught

Ten weeks of relentless automation converted to only 14 real registrations, costing a total of $179.84. The other 12 "catches" ran against a mock/test registrar. This is a low yield, high-volume game: millions of evaluations to snag a handful of cheap domain names. Any one of them could have been an organization's forgotten asset. Because this is fully automated, the overhead is low and an operation can run completely on its own until successful catches are made. Also, 150 domains were lost to “competitors” running similar automation, meaning that, in total,164 domains were ultimately caught by third parties in this 10 week time frame.

Why It Matters

Phishing is perhaps the most common way in which these domains are abused, either by sending emails from the domain, inserting a link to a site hosting a fraudulent page on the domain, or both. But there are other risks associated with squatted domains. A caught domain does not arrive empty. It inherits every scrap of trust the previous owner left pointed at it. The operation's AI scoring exists precisely to find the names where that residual trust is worth the most.

Email and Account Takeover

A former corporate domain keeps receiving password resets, invoices and vendor mail. Whoever controls it can receive and spoof that correspondence.

Traffic and Brand Hijacking

Any live backlinks, bookmarks, QR codes or paid campaigns still referencing the domain can send real users to unauthorized pages hosting parked ads or redirects to other sites entirely.

Dangling Infrastructure

Orphaned DNS records, subdomain aliases (CNAME records), SSO callbacks and API allow lists that still reference the domain can be hijacked the moment someone else owns it.

How To Keep Domains Protected

Several tactics can be employed to prevent domains from ever reaching a state where a third-party of unknown intent can grab them up. These involve administration and maintenance of associated registrations, records and pointers to ensure domains are protected.

Auto-Renew and Monitor Payments

The bot only strikes after a domain fully expires and drops. Enabling auto-renew and registering critical names for multiple years removes them from the target list before the race ever starts. Most accidental domain drops occur because the payment method associated with renewal has lapsed. Monitoring payment methods associated with such transactions can ensure information is refreshed before the next renewal.

Inventory Your Domains

You can’t renew domains you forgot you own. The bots in these logs evaluated 1.19M names and the ones that fall are almost always neglected: retired campaign microsites, old subsidiary brands and defensive registrations such as a company buying a domain that is a common misspelling of their name. Continuous domain discovery across the entire organization and its subsidiaries will surface domains facing imminent renewal. 

Activate Registrar Flags and Registration Locks

Apply clientTransferProhibited / clientDeleteProhibited  flags everywhere. Registry-lock your highest-value names so no single mistake or account compromise can start the expiry clock. Move ownership of domain registration to a role-based, monitored account, never an employee’s personal mailbox.

Monitor Expiry and Domain Status

The exposed domain-grabbing system watches your domain's lifecycle via RDAP. So should you. Set up alerts on any domains entering the redemptionPeriod or pendingDelete state. The 30-day redemption grace window after these statuses take effect is your last chance to recover a name before it becomes catchable.

Strip Residual Value From Expiring Domains

Before retiring a name, decommission its MX and email, remove DNS records, clean up any dangling CNAME aliases and rotate every trust point that referenced it: SSO callbacks, SPF/DKIM includes, API allowlists, etc. A caught domain should inherit nothing worth catching.

Conclusion

The increased awareness around phishing has forced an increase in attack sophistication, primarily in reducing the noticeable gap between a fake email and a real one. As we outlined in our study of domain grabbing attempts on Jev during its peak virality, one way they reduce this gap is by using domains that are easily mistaken as the real thing, for example by being one letter off exampel.com, including the name in a longer string example-ai-security.com, or using similar characters exampIe.com (a capital “i” is used here to replace the “L”). Every realistic touch on a phishing attempt increases its chances of success; and the most realistic phishing domains are those that were actually real at some point. 

Protecting your domains protects your users. Unauthorized domains can be blocked, fraudulent URLs can be detected. However, inventorying and maintaining authorized domains prevents them from later being used to entirely circumvent and undermine those important defenses.