The MSP Security Gap
The domain expired. Someone else bought it.
The scenario:
A wholesale distributor let an old promotional domain lapse two years after a rebrand, the kind of housekeeping task that falls through the cracks when nobody owns the full list of what the company has ever registered.
Twelve months later, that domain was sitting in someone else's hands, and nobody at the distributor knew or had reason to check.
How it unfolds:
The attacker who registered the expired domain waited several months before doing anything with it, long enough that the domain's age and its history in old marketing emails made it look legitimate to any spam filter checking domain reputation.
They then used it to send phishing emails to the distributor's clients and vendors, spoofing the tone of old newsletters that many recipients vaguely remembered receiving before.
Several vendors, recognizing what looked like a familiar sender, clicked through to a fake invoice portal and entered payment details before anyone realized the domain was no longer under the distributor's control.
The warning signs:
An old, unused domain the company registered years ago that nobody has assigned ownership or renewal responsibility for
Vendors or clients receiving emails referencing the company that nobody on the current team sent
A domain's WHOIS registration changing to an unfamiliar registrant, visible to anyone who checks but rarely checked by anyone
Stop it:
Maintain an inventory of every domain the company has ever registered, including retired marketing and campaign domains, with a single owner responsible for renewals
Set renewal reminders well ahead of expiration for any domain still worth protecting, and decide formally to let go of anything abandoned rather than losing track of it by accident
Monitor for lookalike or formerly-owned domains sending mail that references the company, since clients and vendors have no way to know a domain has changed hands
-
P.S. An old domain does not feel like a security asset until someone else owns it and starts using your history against your contacts. The line between "we don't use that anymore" and "we don't control that anymore" is the renewal date, and it passes quietly. Visibility that extends to what the business owns outside its own network, not only what sits inside it, is what catches this before a vendor loses money to a domain the company used to own.