Zombie linkages are keeping expired domains trusted for years

Researchers analyzed "zombie linkages" across Web PKI, Maven Central, and Ethereum Name Service and found large numbers of lingering trust records that outlive domain ownership. They observed many TLS certificates still served after domains expired or were re-registered (including ~192k tied to expired domains and ~7.3k after re-registration), thousands of Maven namespaces publishing after domain ownership changed (4,842 namespaces tied to expired/transferred domains, with hundreds publishing post-transfer), and ENS on-chain mappings that remained outdated for years (23.8% of sampled on-chain linkages). These persistent records create realistic vectors for impersonation, supply-chain compromise, and misdirected cryptocurrency payments because there is limited automatic revocation or reclamation of the stale bindings.