Years ago I bought the carelessly discarded domain of a defence contractor that was acquired by another one. And set up a catch all email forwarder. Had weeks of fun reading all the emails that I got sent. There was nothing "secret" but plenty of social and business stuff still going on.

One risk of pre-validating a domain before purchase is that it's not a good idea to tell strangers about your interest in such a property.

Even automated queries are likely to spill the beans. Someone else could snag the purchase before you, or bid up the price. But it's a risk you may need to calculate.

I wonder if there’s a market for rehabilitating domain names

IP addresses can be haunted too, like if they were previously used for spamming.

Conversely when you drop domain don’t forget you might have accounts on emails or some DNS verification in services that you better explicitly discontinue before just dropping domain.

My very first domain was haunted. The warning sign was firewall blocks against the domain at both school and the public library. As it turned out... a previous owner in the early 2000's was running a sort of proto-Netflix, but with VHS instead of DVD, and that was exclusively targeting the... erm... "adult entertainment" market.

Wayback machine would've saved me there, had I done my due diligence!

Automattic.com was bought (no idea if it was unregistered / acquired) by Matt Mullenweg when he set up the company. He also bought https://a8c.com.

Here in the UK with EE/BT that correctly redirects to automattic.com, but it might not for you depending on your ISP.

The wayback machine shows adult content links prior to the domain being put on sale, hence the blocking.

Not quite haunted but I've had people report that my website hosted on a .quest domain is blocked on their work computer. My best guess is that their filter thinks it's gaming related (it's not) or maybe they just block all "weird" domains.

I've had this with anti-virus flagging domains and VirusTotal was helpful: https://virustotal.com

But it does require manually reporting false positives to each vendor

I’ll add: and if you lease a VPS, check out its address reputation and reverse DNS record.