Expired Domain Hijacking: How Fake Shops End Up on Your Old URLs

Most brand teams think about domain protection in terms of typosquatting and lookalike URLs registered by bad actors. That is a real problem, but there is a quieter one that often goes unnoticed until a customer complains: the domain you used to own, the one tied to a product launch or a seasonal campaign from three years ago, is now hosting a fake shop selling counterfeits under your name.

You did not get hacked. You simply forgot to renew.

The threat is more common than most brand teams realise. WIPO recorded over 6,000 domain dispute cases in 2025, its highest caseload on record. Many of the domains fraudsters go after are not the main company URL. They are the ones that slipped through the cracks: the microsite for a product that was discontinued, the campaign URL from a promotion that ended, the regional landing page that nobody remembered to keep on the renewal list.

This article explains how it happens, why those old domains are so valuable to fraudsters, and what a practical renewal and monitoring policy looks like.

The Domains Most at Risk Are the Ones You Have Already Forgotten

Every company accumulates a long tail of secondary domains. These are not the core brand URL, which is typically auto-renewed. They are the supporting infrastructure built around specific moments:

• Campaign microsites for product launches or seasonal promotions
• Regional landing pages set up for a particular territory
• Product-specific URLs registered when a new line launched
• Event and partnership sites built for a single activation

When the campaign ends, these domains get deprioritised. Renewal reminders go to an email address that no longer exists, or the team that registered them has moved on. The domain lapses, enters a publicly visible deletion queue, and that is where drop-catching begins.

How Drop-Catching Works

Drop-catching is the automated practice of monitoring domain registries for names entering their final deletion phase, then registering them the moment they become available. It is not inherently illegal. Domain investors use it routinely. The problem is that fraudsters use exactly the same infrastructure.

The expiry timeline fraudsters exploit

When a domain is not renewed, it passes through several stages:

• Grace period: the registrant can still renew, usually at standard cost
• Redemption period: renewal is still possible but at a significantly higher fee
• Pending delete: the domain is queued for release, typically for five days
• Drop: the domain is released to the open market

Domain registries publish daily lists of names entering the pending delete phase. Automated drop-catching bots monitor these lists, filter for domains with brand associations, existing backlinks, or prior traffic, and then attempt to register them the instant they are released. The window between a domain dropping and a bot claiming it can be measured in seconds.

Once a drop-catcher secures your old campaign domain, it can be sold, parked, or, increasingly, repurposed as a fraudulent storefront almost immediately.

Key point: The process is fully automated. By the time a human at your company notices the domain has lapsed, it is almost certainly already gone.

Why Your Old Domains Are So Valuable to Fraudsters

A lapsed campaign domain is not just a URL. It carries a history fraudsters can exploit directly.

Inherited search authority

A domain active for two or three years accumulates backlinks, indexed pages, and search authority. When a fraudster rebuilds a fake shop on that URL, search engines do not immediately recognise the change in ownership. The domain can rank for your brand name and product queries before any takedown begins.

Residual trust from users

Customers who bookmarked your old microsite or received the URL in a marketing email may still navigate to it. They arrive at what looks like your brand and have no immediate reason to be suspicious.

Existing inbound links

Backlinks from press coverage and partner pages do not disappear when a domain lapses. A fraudster who registers it inherits those link signals, accelerating how quickly the fake site appears in search results.

An expired brand domain is far more dangerous in the wrong hands than a newly registered lookalike.

This is why fake website detection and removal needs to extend beyond monitoring for lookalike URLs. The real risk is often sitting in your own historical domain portfolio.

Building a Renewal and Monitoring Policy That Actually Works

Most companies have a renewal policy for their primary domain. Very few have one that accounts for the full portfolio of secondary and historical domains. Here is what a practical policy looks like.

Step 1: Audit your full domain portfolio

Compile every domain your organisation has ever registered, including active domains, parked or redirecting domains, campaign and product URLs, and regional variations. Many companies are surprised to discover domains they thought they still owned have already lapsed.

Step 2: Categorise by risk

Tier your domains so effort goes where it matters most:

• Critical: your primary brand domain and any domain tied to active customer communications
• Active secondary: campaign or product domains still receiving traffic or referenced in live materials
• Historical: past campaign domains with no active traffic but with brand association or backlinks
• Low risk: domains with no traffic, no backlinks, and no brand name association

Critical and active secondary domains should have auto-renewal enabled with a multi-year buffer. Historical domains need a decision: renew and redirect, or accept the risk of lapsing.

Step 3: Set up domain monitoring

Renewal management is only half the answer. You also need to know when a domain you previously owned reappears with new content. Remove.tech's brand protection platform monitors domain registrars and search engines around the clock, flagging domains that exploit your brand. When something appears, the platform moves to takedown and de-indexing before the fake site builds search traction.

Step 4: Build a decommissioning process for campaigns

When any campaign or microsite closes:

• Redirect the domain to your main site for at least 12 months
• Keep the domain registered for two to three years after the campaign ends
• Move registrar accounts away from personal or role-based email addresses
• Record the domain in a central asset register with a named owner and renewal date

The brands that get caught out are often the ones where nobody included domain management in the offboarding checklist for a finished project. 

What to Do If a Domain Has Already Been Taken

If you discover that a lapsed brand domain is already hosting a fake shop, act quickly. Your main options are:

• UDRP complaint: the Uniform Domain Name Dispute Resolution Policy lets trademark holders challenge domains registered in bad faith, though the process typically takes several weeks.
• Registrar abuse report: most registrars will suspend domains used for phishing or fraud under their own terms of service, often faster than a formal dispute.
• Search engine de-indexing: getting the fake site removed from search results limits its reach while the domain dispute is ongoing.
• Brand protection enforcement: Remove.tech can initiate takedown procedures and de-indexing requests, reducing the gap between discovery and resolution.

Recovery is possible, but it takes longer and costs more than prevention. If you are not certain your historical domains are being monitored, a free brand audit from Remove.tech is a practical starting point. 

FAQ

What is expired domain hijacking?

Expired domain hijacking is when a fraudster registers a domain that a legitimate brand has allowed to lapse, then uses it to host a fake shop, phishing page, or impersonation site. Because the domain has an existing history, it can carry inherited search authority and user trust.

How quickly can a lapsed domain be taken?

Drop-catching bots can register a domain within seconds of it being released by the registry. Once a domain enters the pending delete phase, it should be considered at risk.

Can I get my old domain back?

Yes, but it is not straightforward. Options include a UDRP complaint through WIPO or direct negotiation with the registrant. Both take time and carry costs. Prevention through timely renewal is significantly easier.

How does Remove.tech help with domain-based brand abuse?

Remove.tech's brand protection platform monitors domain registrars and search engines 24/7, flagging domains that exploit your brand. When a fake site is identified, the platform initiates takedown and de-indexing procedures to limit the damage as quickly as possible.

‍