What Happens to Your Old Domain After You Stop Paying for It?
Keep up with IT Club
Add IT Club as a preferred source in Google Search.
Expired domains can retain links, search history, residual visitors and customer associations after a business moves on. This practical guide explains dropcatching, the Sable Squirrel research, former email domains, DNS housekeeping and the checks UK SMEs should complete before abandoning an old domain.
A business changes its name, launches a new website, merges with another company or retires an old campaign. Eventually somebody notices an old domain renewal and asks: “We're not using that anymore. Why are we still paying for it?”
So the business lets it expire.
That can be a mistake. Once a domain completes its expiry process and becomes available again, somebody else may be able to register it. The old domain may still appear in links, PDFs, email records, QR codes, social posts and customer bookmarks. A new owner may inherit the attention and assumptions attached to that history.
The quick answer
An expired domain does not instantly hand a criminal access to your old website, mailbox or files. Domain endings and registrars usually have an expiry, renewal and release lifecycle, and the exact timings vary.
The risk is what happens after release: another person or organisation may register a domain that still has links, search history, visitor traffic, customer recognition or references to the former business. Some threat actors deliberately buy expired domains because that inherited history has value.
Last checked: 31 August 2026. The sensible decision is not to retain every domain forever. It is to check what still depends on an old domain before deciding whether to renew, redirect or retire it.
What happens when a domain expires?
Expiry is a process, not usually a single moment. The domain may stop resolving, the website or email may be suspended, and the original registrant may have a renewal or restoration window. If it is not renewed, the domain can eventually be released for registration by somebody else. The rules depend on the domain ending and registrar, so check the provider's published lifecycle rather than relying on a generic number of days.
The security concern begins before release. A business may see an old domain as unused because nobody visits the old website internally. The wider internet may still contain references to it, and external systems may still treat an old email address as familiar.
ICANN overview: Life Cycle of a Typical gTLD Domain Name →
What is dropcatching?
Dropcatching is the practice of trying to register a domain at the moment it becomes available after the previous registration ends. Specialist services can monitor domains and submit registration requests quickly.
There are legitimate reasons to do this. Someone may want a memorable name, an established brand or a domain with useful links. But the same characteristics can attract criminals. A newly registered random domain starts with little history. An old business, charity, campaign or organisation domain may already have:
- Links from other websites
- Search-engine history
- Bookmarks and browser history
- Old email references
- References in PDFs and printed material
- QR codes and social-media posts
- Residual visitor traffic
- Customer recognition
That history does not automatically disappear when ownership changes.
What does the recent threat research show?
Infoblox Threat Intel's August 2026 research describes a threat actor it calls Sable Squirrel. Infoblox reports that the actor controls more than 10,000 domains and uses them across illegal sports streaming, gambling promotion and malware command-and-control infrastructure.
Infoblox identified more than US$430,000 in dropcatch purchases across roughly 160 domains that it could price individually. From that sample, it estimated that Sable Squirrel's wider dropcatch spending was above US$7 million. The researchers also identified more than 31,000 malware samples connecting to Sable Squirrel domains.
These are Infoblox Threat Intel's findings and estimates about a specific criminal operation. They do not mean every expired domain is dangerous, that old reputation always bypasses security or that registering a domain gives access to historic mail.
Infoblox's related research describes a separate actor, Shady Squirrel, which it says had acquired more than 700 domains since 2023. That report focuses on “scavenger” activity: acquiring expired domains that had previously been used in malicious traffic or compromised-site chains, then reusing the traffic. It should not be confused with the Sable Squirrel figures.
The useful lesson for an ordinary SME is not the malware sample list. It is that old domains can have value to attackers precisely because they are not new.
Infoblox Threat Intel: $7 Million in Expired Domains Fuel a Streaming Empire →
Infoblox Threat Intel: Dropcatch Scavengers →
Your old domain may still be connected to your business
Before allowing a domain to expire, search for where it still appears. A domain can look unused from inside the business while still receiving visitors from outside it.
- Old websites, landing pages and campaign microsites
- Customer bookmarks and search results
- Email signatures, contact lists and supplier records
- Invoices, brochures, PDFs and printed material
- QR codes and social-media profiles
- Current websites linking to old campaigns, suppliers or products
- Microsoft 365, Google Workspace and other online accounts
- Password-reset addresses, usernames and verification records
- DNS records, subdomains, old web services and obsolete integrations
A fictional example
Illustration — not a real company
Suppose example-oldcompany.co.uk was used by a business for ten years. The business rebrands and moves to example-newcompany.co.uk. After two years it lets the old domain expire, and someone else registers it.
The internet may still contain links to the old website, old staff email addresses, customer bookmarks, PDF documents, social posts and supplier records. Visitors may reasonably assume that the old domain still has some relationship with the original company.
The new owner has not hacked the old business. They have simply bought something the old business stopped protecting.
Former email domains deserve special attention
If an old domain was used for business email, letting it expire deserves particularly careful consideration. Old addresses can remain in customer address books, supplier systems, mailing lists, online accounts and password-recovery settings.
Registering an expired domain does not automatically give somebody historic mailbox access. Old messages and mailboxes remain separate systems. The concern is that a new owner may be able to configure new mail services for addresses at the old domain, creating impersonation or account-recovery risks where external systems still reference those addresses.
Before retiring a former email domain, check aliases, forwarding, shared mailboxes, applications that send from it, supplier records and account-recovery details. Confirm that the domain is removed or replaced in Microsoft 365 and other services where it is no longer needed, without deleting evidence or access that the business still requires.
Can someone pretend to email your customers? Understanding DMARC →
Website links can become a problem too
Businesses sometimes keep links to old campaign domains, former suppliers, discontinued products, partner sites and abandoned projects. If one of those domains changes ownership, the existing link may send customers somewhere completely different.
Review old external links in current websites, customer documentation and public profiles. If a link is still useful, update it. If customers still use the old domain, retaining it and redirecting visitors may be safer than abandoning it. If a link is no longer needed, remove it rather than leaving the destination to somebody else.
What to do when your website is not working →
DNS housekeeping is part of the decision
Domain ownership and DNS are related but separate parts of the business's online identity. Before retiring a domain, review the records and services that still refer to it: websites, subdomains, email, verification records, certificates, monitoring, integrations and third-party platforms.
This is not a request to delete every old record immediately. First understand what it does, who owns the service and what depends on it. Remove obsolete configuration in a controlled way, preserve the information needed for recovery and record the decision.
Microsoft 365 security baseline checklist →
Before you let a domain expire
- 1Check whether it still receives traffic. Review analytics, server logs, registrar information or a bounded redirect period where appropriate.
- 2Check whether it was used for email. Identify old addresses, aliases, forwarding and external accounts that may still reference them.
- 3Search for old links. Look at current websites, documents, profiles, PDFs, printed material and QR codes.
- 4Check online accounts. Make sure the domain is not still used as a username, recovery address or verification contact.
- 5Review DNS. Understand domains, subdomains, records, web services, email configuration and integrations that still point to it.
- 6Redirect where appropriate. If customers still use the old domain, keeping it and redirecting visitors may be safer than abandoning it.
- 7Decide whether to retain it. Do not keep every domain forever, but weigh the domain's history, exposure and continuing associations against the renewal cost.
Automatic renewal helps, but it is not enough
Enable automatic renewal for important domains, but treat that as a safety net rather than the whole control. Check that payment details are current, renewal notifications reach monitored addresses, more than one appropriate person knows who controls the registrar account, and registrar access has strong authentication or MFA where available.
Ownership details should remain under organisational control rather than disappearing with one employee, contractor or former IT provider. This is the same continuity principle that applies to Microsoft 365, backups, banking and other core systems.
Treat domain ownership as a business asset
Businesses often manage laptops, software licences, Microsoft 365 accounts, bank access and intellectual property carefully, while domain names are handled informally. Yet a domain may underpin the website, email, customer trust and online identity at the same time.
Keep a simple domain register with the domain, registrar, renewal date, business purpose, owner, recovery contact and decision about retention. Review it after rebrands, acquisitions, product closures, website migrations and changes to email providers.
Could your business keep running if its owner died tomorrow? →
5-minute business check
Do you know every domain your business currently owns?
- 1Make a list of current and recently retired domains.
- 2Record the registrar and who controls each account.
- 3Record renewal dates and enable automatic renewal where appropriate.
- 4Check MFA on registrar and related administrator accounts.
- 5Identify domains you plan to retire.
- 6Review what still points to each one before allowing expiry.
Frequently asked questions
What happens when a business domain expires?
The exact process depends on the top-level domain and registrar, but an expired domain normally passes through a post-expiry lifecycle before it may eventually be released for registration again. During that period, the website and email may stop working, and the original owner may have a limited route to renew or restore it. Check the registrar's rules rather than assuming expiry means immediate public availability.
Can someone else buy my old business domain?
They may be able to once the domain has completed its registrar and registry expiry process and is released. The timing and renewal or redemption options vary by domain ending and registrar. If the domain still has business links, customer recognition or email references, retaining it or redirecting it may be safer than abandoning it.
Does a new owner get access to old email?
No. Registering an expired domain does not automatically give a new owner access to historic mailboxes or old messages. However, the new owner may be able to configure mail services for addresses at that domain. If outside systems, suppliers or customers still trust old addresses, that can create impersonation or account-recovery risks depending on the system.
What is dropcatching?
Dropcatching is the practice of trying to register a domain as soon as it becomes available after the previous registration ends. It can be legitimate, but an established domain may be attractive because it has existing links, search history, visitor traffic or name recognition.
Should a business keep every old domain forever?
No. The decision should depend on the domain's history, exposure, continuing associations and cost. A domain with no meaningful links or identity may be retired after checks. A former email domain, well-linked website or customer-facing brand may be worth retaining and redirecting.
What should we check before letting a domain expire?
Check whether it still receives visitors, was used for email, appears in documents or QR codes, is linked from current websites, is named in online accounts or recovery settings, remains in Microsoft 365 or other services, and has DNS records or integrations that need removing. Record who controls the registrar and the renewal date, and enable automatic renewal where appropriate.
The IT Club takeaway
When you stop using a domain, the internet does not necessarily stop using it. Before letting an old business domain expire, check what still points to it, what still depends on it and what somebody else could inherit if they bought it tomorrow.
Sometimes the safest option may simply be to keep renewing it. Not sure who controls your domains, DNS or renewals? Ask the IT Club Advisor. We'll help you understand what you have and what actually needs attention.
Plain-English Takeaway
When you stop using a domain, the internet does not necessarily stop using it. Before allowing an old business domain to expire, check what still points to it, what still depends on it and what somebody else could inherit if they bought it.
Related Articles
When AI Can Fool a Security Camera: What Businesses Need to Know
AI-generated visual patterns can make some computer-vision detectors miss people or vehicles even while a camera continues recording. Here is what that means for business security.
Read articleWhat Is AI Memory Poisoning? When Agents Remember the Wrong Thing
AI assistants can remember preferences, facts and instructions across conversations. This guide explains how false information can persist in that memory, why agent permissions matter and what SMEs can do about it.
Read articleZombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments
Researchers at the University of Massachusetts Amherst found that some expired Visa contactless cards could be made to appear valid in particular payment setups. The finding is not a broken encryption story or proof that every expired card still works. It is a lesson in why expiry, revocation and physical disposal must be treated as separate controls.
Read article