{"id":23429,"date":"2019-08-13T17:35:58","date_gmt":"2019-08-13T22:35:58","guid":{"rendered":"https:\/\/www.hostgator.com\/blog\/?p=23429"},"modified":"2019-09-04T16:37:54","modified_gmt":"2019-09-04T21:37:54","slug":"how-hackers-use-expired-domains-to-steal-data","status":"publish","type":"post","link":"https:\/\/www.hostgator.com\/blog\/how-hackers-use-expired-domains-to-steal-data\/","title":{"rendered":"How Hackers Can Use Your Expired Domains to Steal Data"},"content":{"rendered":"\n

When businesses and blogs rename or merge, old domains sometimes get left behind. Security researchers say expired domains can put data at risk. <\/p>\n\n\n\n

Scammers may set up fake shops on expired domains and use them to steal credit card data from unwary bargain hunters. Or they may target email accounts linked to the domain to scam clients, steal company secrets and break into employees\u2019 shopping and travel accounts.<\/p>\n\n\n\n

Prevention is as easy as renewing and protecting all your domains-but that\u2019s not always simple, especially if you own a lot of domains.<\/a> Here\u2019s what you need to know about your risks when a domain expires and how to keep yours current.<\/p>\n\n\n\n

\"register<\/a><\/figure><\/div>\n\n\n\n

What Happens When Domains Expire?<\/h2>\n\n\n\n

The first thing you need to know is that when domains expire, they\u2019re available to anyone who wants to pay to register them. They\u2019re also easy to find online, through sites that offer expired domain name searches and lists of recently expired domains to bid on. Some buyers buy expired domains for legitimate projects. Others are not so ethical.<\/p>\n\n\n\n

Your expired domain could end up as a fake online store<\/h3>\n\n\n\n

Criminal gangs snap up expired domains to turn them into phishing sites. That damages the brands that lose their domains, the brands impersonated by the scammers, and shoppers who fall for the scam. <\/p>\n\n\n\n

Security blogger Brian Krebs profiled a photographer whose old portfolio domain was turned into a fake athletic shoe store after her registration lapsed<\/a>. Thieves used it to steal credit card data for resale on the dark web.<\/p>\n\n\n\n

\"example<\/figure><\/div>\n\n\n\n

For the photographer, the damage went beyond the loss of her website. She had no way to access social media accounts that were linked to her domain email address, because the scammers changed her passwords. Now the domain that used to host her portfolio redirects to the official adidas website, after adidas and Reebok sued the scammers who exploited her expired domain along with hundreds of others. <\/p>\n\n\n\n

Your expired domain could let data thieves into your business<\/h3>\n\n\n\n

Last year, security researchers with Australian cybersecurity firm Iron Bastion proved that registering abandoned business and law firm domains could give criminals access to insider data. <\/p>\n\n\n\n

By setting up a catch-all email forwarding service for domains they re-register, criminals can access confidential client data and emails. They can run scams using this information or sell it on the dark web. They can also take over former employees\u2019 social media, banking, and professional accounts by changing the passwords linked to the old domain\u2019s email addresses. <\/p>\n\n\n\n

What should you do with domains you don\u2019t use anymore?<\/h3>\n\n\n\n

Security experts say the best way to safeguard your old domains is to keep renewing them<\/a>, even if you\u2019re not currently using them. Then you should close the email accounts associated with those domains and unlink those email accounts from alerts sent by banks, airlines, and other services that handle sensitive (and valuable) information.<\/p>\n\n\n\n

If you must let your old domains go, you\u2019ll need to be thorough about updating any online accounts you and your employees set up using old domain email addresses. Then you\u2019ll need to close those email accounts.<\/p>\n\n\n\n

In either case, it\u2019s wise to let your customers and vendors know about your change of email address. Give them some advance notice, ask them to whitelist your new email address, and then ask them to delete the old address when you\u2019ve closed that account. <\/p>\n\n\n\n

For any email account on any domain, it\u2019s always a good idea to set up two-factor authentication (2FA). By requiring a code from an SMS message or an authenticator app, you reduce the risk of someone maliciously changing your password on your email account and other accounts you set up with your email address. <\/p>\n\n\n\n

And speaking of passwords, don\u2019t make it easy for hackers to guess or brute-force yours. Every email address on your domains should have a strong password<\/a> that\u2019s not used for any other accounts. <\/p>\n\n\n\n

How can you keep all your domains current and safe?<\/h3>\n\n\n\n

Follow these recommendations from domain security experts to keep your domains in your possession.<\/p>\n\n\n\n

Give your domain registrations fewer chances to lapse.<\/strong> Start by registering or renewing for the longest amount of time you can, like three years instead of one. Then set your registrations to auto-renew. <\/p>\n\n\n\n

Keep your registration information up to date.<\/strong> Update your domain registration accounts when your email address, phone number, or other contact information changes. Changed credit cards or online payment services? Make sure you change your domain payment information, or your auto-renewals will fail.<\/p>\n\n\n\n

Keep your registration information private.<\/strong> Domain privacy protection<\/a> costs a few dollars a year, and it\u2019s worth it. If you add domain privacy when you register your domain<\/a>, your registrar\u2019s contact information is listed in the WHOIS public database. Without domain privacy, your name, email address, and other personal data are on display. That can put you at risk for spam, scams, and harassment. <\/p>\n\n\n\n

Lock your domains.<\/strong> Domains must be unlocked when you\u2019re transferring them to a new host. Otherwise, lock them to keep scammers from transferring them to a different web host without your consent. <\/p>\n\n\n\n

In HostGator\u2019s Customer Portal, you can lock your domains for free.<\/p>\n\n\n\n