The Domain Expired. The Trust Did Not.
An expired domain can keep receiving trusted traffic after ownership changes. The operational question is whether the organisation can prove that continued use has ended before it releases the name.
Dropcatch is common enough to plan for
For a security team, that scale turns renewal from a calendar task into an evidence decision.
The market figure does not mean that every old domain must be kept. It changes the burden of proof. Release should follow a documented finding that the remaining relationships have been found, assigned and resolved.
The evidence changes the retirement standard
Infoblox’s Sable Squirrel cluster controls over 10,000 domains.
Prices for about 160 purchases exceeded $430,000; the $7 million figure is extrapolated.
The report linked over 31,000 malware samples; some control domains also served sports pages.
The practical output is a stronger retirement standard, rather than an actor-specific blocklist. A team needs a repeatable way to decide whether a name is ready for release and who accepts the risk when evidence is incomplete.
Retirement starts with a decision record
The record should name a business owner, a technical owner and the person authorised to approve release. It should state why the name is no longer needed, what systems and business units were examined, and which result would stop the process.
That structure prevents silence from becoming approval. A missed response, an empty inventory field or the absence of a current website is not evidence that a relationship has ended. Each unresolved item needs an owner and a dated disposition.
The same record should define rollback while the organisation still controls the registration. If unexpected use appears during retirement, the team needs time to restore service, contact the caller and extend observation without racing an expiry deadline.
Observation turns absence into evidence
Use inventories to identify designed relationships and telemetry to identify live ones. Neither view is sufficient alone: inventories can be stale, while an observation window can miss infrequent activity.
Join each finding to a caller, an accountable owner, a last-observed time and a remediation state. That makes the retirement review a set of decisions rather than a collection of search results.
Run the observation period for a duration that reflects the service. A monthly process, a seasonal campaign and software that updates rarely need different evidence windows. Document the chosen duration and the reason for it.
Release needs a stop condition
Before release, require every material finding to be closed, migrated or accepted by a named risk owner. Set explicit stop conditions for new activity, an unknown caller, incomplete ownership or a failed migration.
When a material relationship cannot be closed, defensive renewal may be the safer decision. Give that renewal a review date and a reason. This avoids both accidental release and permanent retention without scrutiny.
Continuity belongs in detection
Detection should treat registration state as a timeline, then join it to DNS, certificates, hosting, content and the process making each request. A single age value cannot carry all of that context.
Alert when the expected continuity breaks or when a retired relationship becomes active again. Route that event to the owner named in the retirement record, with the evidence that caused the change in score.
A safe retirement ends with an accountable release decision. The organisation should be able to show what it examined, what it observed, who approved the remaining risk and which signal would reopen the case.
