A domain that lapses does not disappear. It enters a sequence of stages, and at the end of that sequence, anyone can register the name, including someone who wants the traffic, the email or the reputation that came with it.
Hijacking through expiry rarely involves hacking. A card expires, a renewal reminder lands in a mailbox nobody reads, or the employee who registered the domain leaves, and the registration quietly runs out. Specialists then watch lists of names about to drop and register the valuable ones the moment they become available.
The mechanics are explained clearly in the DotRoll article. It describes the redemption grace period as a final recovery stage of about 30 days after the initial grace period ends, notes that for generic domains such as .com, .net, and .org the stage is enforced by ICANN, and says that a domain not redeemed within it moves on to pending delete. Once the name is released, a new registrant gets it with nothing to prove.
The consequences go beyond a dead website. Whoever registers the old name can point it at a copy of the brand, send mail from it, receive messages addressed to old employees and reset passwords for accounts that still use an address on that domain. Search engines also keep indexing the old pages, so visitors who arrive from existing links may land on content the brand never approved, and customers who trusted the address may hand over payment details to a stranger. Recovering from that kind of incident takes months, because trust returns more slowly than traffic.
Read the full explanation at https://dotroll.com/en/blog/what-is-a-do…mption-period/.
The rules for generic domains are set out in ICANN's Expired Registration Recovery Policy. Registrars must notify the registered name holder of the expiration at least twice before it happens, and ICANN's guidance for registrants describes those reminders as arriving about a month and about a week ahead. After expiry, the previous holder must still be allowed to renew the registration for a period, and a Redemption Grace Period of 30 days follows deletion, during which the registry disables DNS resolution and prohibits transfers.
The process differs by registry. DotRoll's article on .hu domains explains that an expired .hu name sits in redemption status for 45 days, where the owner can buy it back, then spends 60 days in a cancellation period with an extra fee, and becomes available to anyone after 105 days. A brand with names under several extensions therefore faces several timetables.
During redemption, the website and email stop working, and restoration usually costs more than a normal renewal. The cheapest recovery is the one that never happens.
Buyers of dropped names are organized. Backorder services place a bid for a name before it is released, auction platforms sell expiring names to the highest bidder, and monitoring tools alert subscribers when the status of a domain changes. Registrars such as DotRoll sell backorder and name watch services themselves, which shows how routine the activity is. The market for expired names is large enough to support full-time businesses.
A brand with traffic, backlinks, or a recognizable name is more attractive than a blank name, and the danger grows with the age of the domain. Attackers also pay attention to subdomains and to services connected to the main domain, since a forgotten DNS record that points to a retired cloud resource can be claimed independently of the domain itself. Monitoring services that track DNS changes, certificate issuance for the domain, and the appearance of lookalike names give an early warning, and many are free or inexpensive for a handful of domains.
Prevention is mostly administrative, and a few habits close the common gaps.
Consider also registering the obvious variants of the brand name, such as common misspellings and the main alternative extensions, and point them at the main site. The cost is small next to a phishing site that looks like the company's own.
Act the day the lapse is noticed. Check the status of the domain in the registry's lookup service and contact the registrar, who can tell whether the name is in a grace period, in redemption or already released. During redemption the owner can restore the domain through the current registrar, paying the redemption fee on top of the renewal.
If the name has been registered by someone else, the options narrow. Brand owners with a registered trademark can file a complaint under the Uniform Domain Name Dispute Resolution Policy, which exists for names registered in bad faith. In parallel, tell customers and partners through other channels, reset passwords on any account that used an address on the lost domain and move critical services to a new domain that is fully controlled. Document the incident as it unfolds, since the timeline helps with registrar complaints, insurance claims and any later legal steps.