Lapsed domains behind 2,000 abandoned IoT apps have changed hands, study finds

The path runs through DNS. An abandoned app has a server name compiled into it, and when the registration on that name lapses, whoever registers it next answers the app's next request. Nothing tells the app the endpoint changed hands, and an app pulled from Google Play has no update channel at all. A sample check of registration history found still-active domains that had changed owners since the app's last update, affecting more than 2,000 apps ^[7].

Whoever answers receives what the app was already sending. External storage access, precise location and camera access each appeared in tens of thousands of the apps, and data collected under those permissions travels almost entirely over Wi-Fi ^[9]. The researchers wrote that a maintained app can respond when an endpoint breaks and an abandoned one cannot ^[17].

Three in four of 61,500 is roughly 46,000 apps carrying dependencies tied to documented vulnerabilities ^[1][18], and most of the flagged issues sit in the higher severity tiers ^[4]. The gap the study treats as specific to abandonment is the data-flow one. 38.4% of unique sources and sinks pointed at domains classed unreachable, blocklisted or under changed ownership ^[10]. The same pipeline ran over 500 of the most-installed IoT apps that had shipped an update since March 2025, and there the figure was under 1% ^[11]. That is a factor of at least 38, measured against a comparison group picked by install count ^[19].

Some of those destinations are already known bad. Roughly one in nine extracted addresses matched threat intelligence blocklists, with hundreds of exact hits for phishing, scam, spyware and malware links. More than two-thirds of the apps held at least one blocklisted domain ^[8].

One finding cuts against the abandonment framing. A modest share of the abandoned apps use DES, MD5 or RC4. That share is lower than in the active comparison set. The researchers interpreted weak cryptography as a habit across the IoT app ecosystem generally ^[12].

"This degree of abandonment is particularly alarming given that users expect that IoT devices remain in active use for roughly a decade on average," the researchers wrote, "a lifespan that far outlasts the maintenance commitments from vendors for companion applications" ^[13]. They also counted 869,000 apps on Google Play with no update in over two years ^[15].

The study covers code, dependencies, DNS reachability and registration history; it does not report anyone observed collecting data through a re-registered endpoint, or how often these apps sit on phones that also carry corporate mail ^[20]. Disclosure went out from mid-June to developer addresses extracted from the apps. Close to one in five messages bounced as undeliverable, and of the vendors who replied, a small number pulled their app from Google Play ^[16].