Infoblox Data Shows 50,400 Daily Dropcatch Domains Captured for Scam Redirection in H1 2026

Infoblox telemetry recorded 50,400 gTLD and 65,000 total dropcatch registrations per day, representing nearly 20 percent of all new domains. .net and .xyz led volume while GoDaddy, Namecheap, and DropCatch.com handled the majority of backorders and auctions. Expired domains retain cached search results, email flows, and residual inbound links that bypass reputation filters and enable immediate traffic monetization. Analysis of registrar auction mechanics reveals that automated scripts win high-value domains within milliseconds of deletion, outpacing manual defensive registrations. Lingering MX and A records create open relays and subdomain takeover vectors not addressed by standard grace-period policies. This pattern mirrors prior documented cases of expired .gov and .edu domains repurposed for phishing, indicating a systemic gap in post-expiration DNS hygiene across both commercial and public sectors. Procurement records from multiple registrars show no mandatory reputation scoring at the point of dropcatch registration. Without registry-level checks or mandatory WHOIS verification tied to prior ownership history, the same infrastructure will continue scaling. Expect increased use of these domains for initial access brokers selling traffic to ransomware operators within the next two quarters.