New Infoblox Threat Intel research puts the average at about 50,400 dropped generic top-level domain names re-registered every day during the first half of 2026—nearly one in five observed daily gTLD registrations.
Ech’s short answer
Infoblox observed an average of 50,400 dropped gTLD domains being re-registered each day during the first half of 2026. That was nearly 20% of all observed daily gTLD registrations. When the researchers added the ccTLDs they could measure, the total rose to around 65,000 dropcatch domains per day.
Dropped domains are not the same as brand-new domains. They have been registered before, disappeared from the active registration pool and then been registered again—sometimes within moments of becoming available.
Infoblox Threat Intel measured that activity at scale using historical domain records and creation-date data. Its August 2026 research shows that re-registrations make up a surprisingly large share of the daily gTLD market.
The figure is an average from Infoblox observations covering the first half of 2026, rather than a fixed number that repeats every day.
Infoblox Threat Intel reported that, when looking only at generic top-level domains, an average of 50,400 previously registered domains were re-registered each day. Those dropcatch registrations accounted for nearly 20% of all daily gTLD registrations observed in the dataset.
Put another way, the researchers found that close to one in five observed gTLD registrations had a previous life. The domain may have belonged to a business, a project, an investor, a malicious operator or any other registrant before it expired or was deleted and later returned to the registration pool.
Adding the country-code TLDs that Infoblox could measure increased the observed average to around 65,000 re-registered domains per day. The researchers said the overall dropcatch share remained around 20%.
Infoblox counted domains that had been seen before and later reappeared with a new creation date. A domain that changes hands without being deleted normally keeps its original creation date, so ordinary ownership transfers are not counted as dropcatch events in this dataset.
Infoblox found that roughly 92% of the gTLD dropcatch domains it observed came from only 15 top-level domains.
Nearly three in ten newly observed registrations had previously existed and were later re-registered.
Its measured dropcatch rate was also close to three in ten newly observed registrations.
The largest contributor by volume had a reported dropcatch rate of 24.5%.
The same research also looked at where caught domains ultimately appeared by registrar. Its median daily figures for 2026 put GoDaddy first among the measured registrars at 5,246 re-registered domains, followed by Namecheap at 4,385 and DropCatch.com at 3,568.
Dynadot followed at 2,525 and Spaceship at 2,390. Infoblox described the broader list as a mix of traditional registrars, investor favourites, specialist dropcatch services and companies that also operate expired-domain auction platforms.
Expiration does not always mean immediate availability. Many gTLDs pass through recovery and redemption stages before deletion.
Some expiring domains are also sold through registrar-run auction systems before they ever reach a full deletion and public release. If a domain does drop, specialised services monitor the registry and send automated registration attempts as soon as the name becomes available.
When several customers want the same domain, a successful catch may lead to an auction rather than an automatic award to one buyer. That competition helps explain why attractive expired domains can disappear from the open registration pool almost immediately.
The exact lifecycle varies by registrar, registry and TLD. A domain can still be renewable, restorable or headed to an expiry auction before it becomes available for ordinary registration.
Previous use can leave behind reputation, traffic and technical connections that make an expired domain valuable—or risky.
Old links, bookmarks and search results can continue sending visitors to a domain after ownership changes.
An older domain may still carry signals associated with its previous legitimate use.
Messages intended for a previous owner can sometimes continue arriving after the domain has been re-registered.
Forgotten references and infrastructure dependencies can persist after the original organisation stops using the name.
Those inherited signals are one reason expired domains attract legitimate end users, domain investors, defensive security teams and malicious actors alike. A memorable name with history can have commercial value, while a forgotten technical connection can create an unexpected security problem.
Infoblox's research warns that threat actors can take advantage of the trust and connections attached to a domain's previous life. That does not make dropcatching itself malicious; the same market also includes ordinary investors, businesses recovering useful names and researchers acquiring domains defensively.
Bottom line
That is the average Infoblox observed during the first half of 2026. It represents nearly 20% of daily gTLD registrations in its dataset, showing that a significant part of the domain market is made up of names returning for another life rather than being registered for the first time.
