Infoblox Threat Intel has revealed how cybercriminals exploit “dropcatch” domains, re-registering approximately 65,000 expired addresses daily to inherit existing trust and traffic. The research highlights major threat actors like Sable Squirrel, who invested over $7 million in 10,000 domains to facilitate illegal streaming, gambling, and malware distribution. By repurposing legitimate and malicious expired infrastructure, these actors bypass security hurdles to deliver payloads including SocGholish and various remote access trojans.
One investigation uncovered a threat actor dubbed Sable Squirrel, who researchers estimate has invested more than $7 million acquiring over 10,000 expired domains. Those domains underpin a criminal ecosystem spanning illegal streaming, online gambling and malware distribution, demonstrating how expired domains have evolved from forgotten web addresses into valuable cybercriminal infrastructure. Notably, Sable Squirrel operates command-and-control (C2) nodes for multiple remote access trojans (RATs) on the same infrastructure as illegal content.
Sable Squirrel acquires legitimate domains to capture their positive reputation, but other threat actors take over well-known malicious domains that were inserted into compromised websites. Across three additional newly identified threat actors, Infoblox Threat Intel found thousands of dropcatch domains embedded in tens of thousands of compromised websites that continue directing victims to various malicious payloads.
Most notably, the research uncovered one actor who uses tactics to deliver potential victims to SocGholish, the notorious “fake update” infrastructure which was the target of Operation Endgame in June 2026. This threat actor, tracked as Shady Squirrel by Infoblox Threat Intel, delivered malware through scareware and call centers before partnering up with SocGholish’s operator TA569 in July.
“The sheer volume of dropcatch domains is astounding. We’ve known that bad guys buy expired domains to repurpose them, but the way in which they were used, and the amount of money actors are willing to spend wasn’t well understood.” said Dr. Renée Burton, VP of Infoblox Threat Intel. “Expired domains can be a shortcut to both trust and traffic, making dropcatch domains a higher risk than the average newly registered domain.”
The research is detailed in a three-part series from Infoblox Threat Intel:
- Part 1: Explains how dropcatch domains retain trust, reputation and traffic after expiring, creating opportunities for abuse.
- Part 2: Details the Sable Squirrel investigation, revealing a criminal operation that invested more than $7 million in expired domains to support illegal streaming, gambling and malware.
- Part 3: Profiles three additional threat actors – Stuffy Squirrel, Shady Squirrel and Swiping Squirrel. These threat actors acquire expired malicious domains to inherit victim traffic from previously compromised websites, redirecting users to scams, malware and advertising fraud. Together, they demonstrate how threat actors profit from infrastructure built by other criminals.
