Before it is taken away! It's time to review your domain management method

Risks Associated with Domain Management

One of the most common risks in domain management is the practice known as domain drop catch (In this article, "domain" refers to the domain names used for websites and email addresses - for example, example.com).
Domain drop catch occurs when a domain that is no longer in active use expires, becomes unregistered, and is then acquired by a third party the moment it becomes available again.
Domains with existing page view history or prior usage records are particularly attractive targets. If such a domain is seized by a malicious third party, it can be repurposed for affiliate advertising, or in the worst case, exploited for criminal activities such as phishing, fraud, or malicious distribution.
In addition, if attackers acquire email addresses under the recovered domain, they can perform email spoofing, leading to secondary damages such as leakage of sensitive information, unauthorized instructions, or malware infection through malicious attachments.
Another major risk associated with domain drop catch is subdomain takeover.
A subdomain takeover occurs when an attacker re-claims a subdomain that remains registered in an organization's DNS records, even though the original service it pointed to has already been discontinued. The attacker then binds the subdomain to infrastructure they control, redirecting users to malicious or fraudulent content (Figure 1).
This attack method has existed for many years, but it has become significantly more common with the widespread use of cloud services and CDN (Content Delivery Network) platforms. Subdomain takeovers are particularly likely in these environments because:

• Many clouds or SaaS services allow arbitrary users to request subdomains under shared domains.
• Orphaned DNS records - entries pointing to decommissioned cloud resources - are easy to overlook.
• Deleting DNS entries is often not part of standard offboarding or service-retirement procedures.

Unlike top level domains, which are difficult for third parties to obtain, subdomains within cloud or SaaS systems can often be recreated by anyone, making them high-risk and easy targets for takeover.

Figure 1: Principle of subdomain takeover in cloud service usage

Identifying Risks

1. Identify Domain Names Currently in Use

Organizations should maintain a complete inventory of all domains they own and establish a centralized management process for acquiring, updating, and retiring domains.
If no official domain ledger exists, tracking them can be challenging, but a partial inventory can still be created by reviewing DNS records to identify domains that are no longer actively used.
As noted earlier, subdomain takeovers often occur due to unused or orphaned DNS records, so domains that still have DNS entries but are not used in the business represent a high-risk situation.
It is therefore essential to manage both the domains themselves and their associated DNS entries appropriately.

2. Identify Domains Vulnerable to Cybersquatting and Typo squatting

Detecting third-party registration of similar or misleading domains requires more active investigation.
For this analysis, we used a tool called dnstwist (https://github.com/elceef/dnstwist) to scan for domains similar to "example.com," a reserved domain used for demonstration purposes.
dnstwist generates a list of similar domains using multiple algorithms, then queries their DNS records to determine whether they have been registered. For each detected domain, we also conducted a separate background check using public reputation services.

The algorithms used to generate similar domains include:

• Adding one character
• Replacing or removing a character
• Changing characters to adjacent keys
• Adding hyphens
• Bit squatting (*1)
• Changing the top-level domain (TLD) (*2)

In our analysis, 94 candidate domains were detected (Figure 2). Of these, 41 domains were classified as potentially malicious by reputation services.
Using tools that incorporate additional patterns - such as variations across multiple TLDs - enables even broader detection of suspicious domains that may pose risks to the organization.

Notes

• (*1) Bit squatting:
  A phenomenon where a single bit flip occurs during DNS resolution (e.g., due to hardware or transmission errors). Attackers exploit this by registering domain names that differ by one bit from legitimate domains.
• (*2) Top-Level Domain (TLD):
  The highest level of the domain hierarchy, such as ".com", ".jp", or ".net", which appears at the end of an internet domain name.

Figure 2: Some of the DNSTWIST detection results

Effective Measures

Based on past domain related incidents handled by NTT DATA-CERT, it has taken an average of approximately 10 months from the detection of a domain drop-catch incident to the completion of the reacquisition procedure. As this demonstrates, recovering a domain once it is taken by a third party requires significant time, cost, and effort. Therefore, the most effective approach for companies is to prevent domain drop catch before it occurs.

What to Do If Your Domain Is Acquired by a Third Party

If a domain is hijacked via drop catch or acquired as part of cybersquatting or typo squatting, there are formal dispute resolution processes that can be used.
Under UDRP (*3) and JP-DRP (*4), you can request domain transfer or suspension if you can prove that the registration or use is unlawful. These procedures apply not only to drop-caught domains, but also to cases of cybersquatting and typo squatting.
However, for cybersquatting or typo squatting, the burden of proof may be higher.
Because the claimant often:

• has no recent track record of using the domain, and
• may not have direct trademark wording in the domain,

it can be more difficult to demonstrate bad-faith registration compared to domain drop catch scenarios.
Even so, it is still possible to file a claim if evidence shows malicious use - such as:

• phishing or fraud conducted on the domain,
• malware-distributing pages,
• impersonation sites, or
• intentional misuse of brand reputation.

Providing clear documentation of harmful activity strengthens the dispute claim.