What Is Domain Kiting? Definition & Examples

Domain kiting is a tactic where a domain name is repeatedly registered, used briefly, then deleted before the grace period ends and re-registered to avoid paying for it. In security and identity contexts, it can support disposable infrastructure, evade reputation controls, and complicate ownership tracking for malicious services.

How domain kiting works

Domain kiting is a churn tactic, not a technical vulnerability in the DNS protocol itself. The operator repeatedly registers a name, uses it briefly, lets it drop before the grace period closes, then re-registers it to keep control while avoiding recurring registration fees.

That pattern matters because the domain can remain available just long enough to host phishing pages, redirect traffic, deliver malware, or support short-lived command-and-control infrastructure. The operational value comes from the ability to reset the registration lifecycle before reputation systems, abuse reports, or ownership tracking can settle.

Why it is attractive to malicious operators

Disposable domains reduce the cost of abuse and raise the cost of defender response. When a domain is abandoned and re-registered in cycles, investigators may see changing registrant details, inconsistent DNS history, and short-lived hosting relationships that complicate attribution.

It also weakens trust signals that defenders often rely on, such as domain age, registration continuity, and stable ownership. A freshly registered name is already suspicious; a repeatedly recycled one can make that signal noisier while still letting the operator preserve access to the namespace.

For defenders, the main lesson is that ownership continuity is a security signal, not just an administrative detail. NIST Cybersecurity Framework 2.0 is useful here because it frames asset identification and protection as ongoing disciplines, which is exactly what churned domains try to evade.

How organisations check exposure

Exposure starts with knowing where domain names are used across your environment, including marketing sites, SaaS onboarding flows, redirect chains, hosted content, and third-party integrations. If a business process depends on a domain name that can be rapidly replaced, the organisation may miss the loss of continuity until users or controls begin failing.

Teams should also look for internet-facing dependencies that trust registration age, WHOIS stability, or domain reputation as a control input. Those signals can be manipulated by kited domains, especially when short registration windows and disposable hosting are used together.

From a control perspective, DNS visibility, inventory discipline, and external attack-surface monitoring matter more than spot checks. CSA Cloud Controls Matrix and NIST Cybersecurity Framework 2.0 both support that broader inventory-and-monitoring view.

Defensive controls and detection

When domain kiting is suspected, defenders should focus on the surrounding infrastructure pattern rather than the domain alone. Repeated registration, short-lived DNS records, rapidly changing hosting, and clustered certificate or redirect behaviour can be more revealing than any single registration event.

Abuse response should also assume that a kited domain may be only one throwaway element in a larger campaign. Correlating the domain with IP ranges, hosting providers, TLS certificates, and observed phishing or malware delivery helps determine whether the same operator is reusing supporting infrastructure under new names.

For control mapping, NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant because it includes access control, audit, and configuration-oriented safeguards that help organisations retain visibility over externally exposed assets, while MITRE ATT&CK Enterprise Matrix helps map how disposable infrastructure supports credential theft, delivery, and command-and-control activity.

Identity and ownership implications

In identity and trust workflows, domain kiting can hide who really controls a service at a given moment. That creates a practical problem for users, security teams, and downstream systems that treat domain ownership as a proxy for legitimacy or continuity.

The identity impact is often indirect but still material: if a domain fronts login flows, email services, webhooks, or API endpoints, churn in registration and hosting can expose credentials, sessions, or trust relationships to abuse. In those cases, the domain is part of the trust boundary, not just a naming convenience.

That is why registration churn should be treated as an operational trust issue, not only a billing trick. NIST SP 800-63 Digital Identity Guidelines is a useful reference when the domain is tied to authentication or identity assurance, because it reinforces the need to protect the integrity of the channels users rely on.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Physical devices and systems within the organization are inventoried	Domain kiting affects external assets that should still be inventoried and tracked.
	DE.CM-01 — Networks and network services are monitored to find potentially adverse events	Churned domains are detected by monitoring DNS, hosting, and registration changes.
Recommendation — Maintain an accurate inventory of internet-facing domains and their ownership paths. Monitor domain-registration and DNS changes for rapid churn and abuse patterns.
NIST SP 800-53 Rev 5	AU-6 — Audit Record Review, Analysis, and Reporting	Reviewing logs and records helps correlate disposable domains with abuse activity.
Recommendation — Correlate domain events, DNS logs, and web telemetry to identify abuse campaigns.
CIS Controls v8	CIS-15 — Service Provider Management	Domain kiting often relies on third-party registrars, hosts, and related providers.
Recommendation — Govern registrar and hosting providers as part of third-party risk management.
MITRE ATT&CK	T1583 — Acquire Infrastructure	Disposable domains are a common way to acquire and rotate adversary infrastructure.
Recommendation — Map repeated domain registration to infrastructure acquisition and monitor for reuse.

Domain Kiting