Expired Domains Can Expose Email and Account Recovery Paths

Summary

Scammers may re-register expired domains to receive email and password-reset links for accounts tied to them. The article recommends renewing domains and closing unused accounts, and describes risks from dormant domains.

Key points

• A person who re-registers an expired domain may receive email sent to addresses previously using that domain.
• Password-reset links delivered to recovered email addresses could provide a route into associated online accounts.
• The author says email and DMARC reports for JE Pistons and Wiseco began arriving after the author registered a lapsed corporate domain.
• The article recommends renewing owned domains indefinitely and closing accounts for services no longer used.
• The article also says an assessment of 364 domains at a real estate group found 79 carrying traffic the group had not authorized.