Expired or abandoned domains can be registered by other individuals or entities, including cybercriminals, who would use the domain to carry out phishing attacks against customers of the same company. Even if the domain registration has expired, it does not mean that access to that business has been removed. Cybercriminals can intercept emails from customers and employees of former domain owners, as well as gather sensitive information.