[Breaches](/breaches) The Domain Drop Race: How an AI-Powered Squatting Pipeline Hunts Expiring Names [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # The Domain Drop Race: How an AI-Powered Squatting Pipeline Hunts Expiring Names ##### [Greg Pollock](/team/greg-pollock) Published Oct 21, 2026 ##### Join 27,000+ cybersecurity newsletter subscribers The average time between when a valuable domain becomes available and when an automated domain harvesting system registers it for themselves is 144 milliseconds. We know this because UpGuard researchers discovered an exposed Elasticsearch server with logs from one of these systems that detected newly expired domains, judged their relative value using AI and attempted to register them before anyone else could. For defenders, this means there is no room for error in maintaining domain registration. In less than a second, it will be gone.  The domain [lifecycle](https://archive.icann.org/en/registrars/gtld-lifecycle.jpg) requires that registrations be actively renewed. If this renewal fails, the domain becomes available to the public for purchase. For primary domains, this is rarely a problem, as these assets are closely guarded and constantly in use. However, secondary or tertiary domains can easily fall by the wayside and when they do, they are ripe for the taking by fraudulent actors looking to impersonate the associated organization. # Data Analysis The publicly exposed server contained six indices: three months of application event logs for the catching engine (domain-logs, \~4.17M docs) and three per-request logs of registration attempts (registrar-requests, \~580K docs). Together they provide a complete, timestamped operations record of an automated squatting operation over ten weeks. ## The Domain Squatting Pipeline The whole operation consists of a six stage pipeline: harvest, score, watch, detect, attack and reconcile. For all that, only a very small number are actually captured. Competition is stiff for valuable domains. ## TLD Breakdown The target mix shows what these operations prize: high-trust legacy TLDs and the current speculative gold rush. Roughly a third of all activity targeted .com domains. However, the .ai TLD alone drew 658K events, illustrating the AI-domain land grab in real time. ## What It Caught Ten weeks of relentless automation converted to only **14** real registrations, costing a total of $179.84. The other 12 "catches" ran against a mock/test registrar. This is a low yield, high-volume game: millions of evaluations to snag a handful of cheap domain names. Any one of them could have been an organization's forgotten asset. Because this is fully automated, the overhead is low and an operation can run completely on its own until successful catches are made. Also, 150 domains were lost to “competitors” running similar automation, meaning that, in total,**164** domains were ultimately caught by third parties in this 10 week time frame. # Why It Matters Phishing is perhaps the most common way in which these domains are abused, either by sending emails from the domain, inserting a link to a site hosting a fraudulent page on the domain, or both. But there are other risks associated with squatted domains. A caught domain does not arrive empty. It inherits every scrap of trust the previous owner left pointed at it. The operation's AI scoring exists precisely to find the names where that residual trust is worth the most. **Email and Account Takeover** A former corporate domain keeps receiving password resets, invoices and vendor mail. Whoever controls it can receive and spoof that correspondence. **Traffic and Brand Hijacking** Any live backlinks, bookmarks, QR codes or paid campaigns still referencing the domain can send real users to unauthorized pages hosting parked ads or redirects to other sites entirely. **Dangling Infrastructure** Orphaned DNS records, subdomain aliases (CNAME records), SSO callbacks and API allow lists that still reference the domain can be hijacked the moment someone else owns it. # How To Keep Domains Protected Several tactics can be employed to prevent domains from ever reaching a state where a third-party of unknown intent can grab them up. These involve administration and maintenance of associated registrations, records and pointers to ensure domains are protected. **Auto-Renew and Monitor Payments** The bot only strikes after a domain fully expires and drops. Enabling auto-renew and registering critical names for multiple years removes them from the target list before the race ever starts. Most accidental domain drops occur because the payment method associated with renewal has lapsed. Monitoring payment methods associated with such transactions can ensure information is refreshed before the next renewal. **Inventory Your Domains** You can’t renew domains you forgot you own. The bots in these logs evaluated 1.19M names and the ones that fall are almost always neglected: retired campaign microsites, old subsidiary brands and defensive registrations such as a company buying a domain that is a common misspelling of their name. Continuous domain discovery across the entire organization and its subsidiaries will surface domains facing imminent renewal.  **Activate Registrar Flags and Registration Locks** Apply [*clientTransferProhibited* / *clientDeleteProhibited*](https://www.icann.org/resources/pages/epp-status-codes-2014-06-16-en)  flags everywhere. Registry-lock your highest-value names so no single mistake or account compromise can start the expiry clock. Move ownership of domain registration to a role-based, monitored account, never an employee’s personal mailbox. **Monitor Expiry and Domain Status** The exposed domain-grabbing system watches your domain's lifecycle via RDAP. So should you. Set up alerts on any domains entering the *redemptionPeriod* or *pendingDelete* state. The [30-day redemption grace window](https://www.icann.org/en/contracted-parties/consensus-policies/expired-registration-recovery-policy/expired-registration-recovery-policy-28-02-2013-en) after these statuses take effect is your last chance to recover a name before it becomes catchable. **Strip Residual Value From Expiring Domains** Before retiring a name, decommission its MX and email, remove DNS records, clean up any dangling CNAME aliases and rotate every trust point that referenced it: SSO callbacks, SPF/DKIM includes, API allowlists, etc. A caught domain should inherit nothing worth catching. # Conclusion The increased awareness around phishing has forced an increase in attack sophistication, primarily in reducing the noticeable gap between a fake email and a real one. As we outlined in our [study of domain grabbing attempts on Jev](https://www.upguard.com/breaches/jev-ai-domain-brand-impersonation) during its peak virality, one way they reduce this gap is by using domains that are easily mistaken as the real thing, for example by being one letter off *exampel.com*, including the name in a longer string *example-ai-security.com, *or using similar characters *exampIe.com *(a capital “i” is used here to replace the “L”). Every realistic touch on a phishing attempt increases its chances of success; and the most realistic phishing domains are those that were actually real at some point.  Protecting your domains protects your users. Unauthorized domains can be blocked, fraudulent URLs can be detected. However, inventorying and maintaining *authorized* domains prevents them from later being used to entirely circumvent and undermine those important defenses. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)