Aged Domains

Adversaries may acquire and re-register expired domains that retain reputation or history and may already be trusted or allowlisted by defenders. This entry is scoped to expired-domain reuse within MITRE ATT&CK T1583.001, Acquire Infrastructure: Domains. New registrations and lookalike domains are broader variants of the same sub-technique. WHOIS/RDAP registration data can be privacy-redacted and does not by itself establish malicious use. Route 53 registration creates a hosted zone with a separate monthly fee, and DNS queries may incur additional charges beyond the domain registration fee.