- Messages
- 4,003
- Likes
- 1,873
- Points
- 2,130
Security specialists from Infoblox are warning of a large-scale scheme using expired domains. Attackers are buying up these addresses en masse, along with their reputation, old traffic, and backlinks, and then using them to carry out fraudulent schemes, distribute malware, and redirect users. One hacker group, Sable Squirrel, spent nearly $7 million on domains.
Infoblox refers to these re-registered addresses as dropcatch domains and reports that in the first half of 2026, approximately 50,400 such domains were re-registered daily in generic domain extensions (.com, .org, .net, etc.), and when including national extensions, the figure reaches approximately 65,000 domains per day. As a result, dropcatches account for approximately 20% of new registrations per day (every fifth newly registered domain).
Typically, the value of such addresses is linked to their "past life": they may retain a good reputation in security systems, maintain old links, and attract residual traffic from previous sites. Furthermore, old addresses in such domains may still receive emails, and DNS records sometimes open up additional attack vectors.
Researchers say the Sable Squirrel group is a prime example of this type of activity. Infoblox estimates that its operators control over 10,000 domains and have been purchasing expired addresses since at least June 2023. The group's core business is pirated sports broadcasts for Asian audiences, which redirect users to online betting sites.
Part of Sable Squirrel's infrastructure is also used for malware: over 31,000 malware samples, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, and njRAT, have accessed the group's domains. Moreover, some websites simultaneously displayed sports broadcasts to visitors and served as command and control servers for malware.
For example, the attackers acquired the domain cel-robox[.]com, previously owned by a desktop 3D printer manufacturer, and turned it into both a pirate streaming site and a command and control server for the Quasar RAT.
The report also notes that the group acquired former domains of projects belonging to such large companies as General Electric, Procter & Gamble, and Sony.
Researchers note that the attackers try to exploit the acquired domain reputation as quickly as possible: 24% of dropketch domains purchased by Sable Squirrel become operational on the day of registration, 76% within a week, and 94% within two weeks.
It is emphasized that Sable Squirrel is far from the only hacker group profiting from old domains. The company's analysts also monitorThe Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel groups control thousands of addresses and intercept traffic left over from previous owners. This traffic is typically redirected to advertising networks, fraudulent sites, and other cybercriminals.
Experts warn that domains with a good history can transform from trusted resources into part of a malicious infrastructure almost immediately after their registration expires and they are transferred to new owners.
Infoblox refers to these re-registered addresses as dropcatch domains and reports that in the first half of 2026, approximately 50,400 such domains were re-registered daily in generic domain extensions (.com, .org, .net, etc.), and when including national extensions, the figure reaches approximately 65,000 domains per day. As a result, dropcatches account for approximately 20% of new registrations per day (every fifth newly registered domain).
Typically, the value of such addresses is linked to their "past life": they may retain a good reputation in security systems, maintain old links, and attract residual traffic from previous sites. Furthermore, old addresses in such domains may still receive emails, and DNS records sometimes open up additional attack vectors.
Researchers say the Sable Squirrel group is a prime example of this type of activity. Infoblox estimates that its operators control over 10,000 domains and have been purchasing expired addresses since at least June 2023. The group's core business is pirated sports broadcasts for Asian audiences, which redirect users to online betting sites.
Part of Sable Squirrel's infrastructure is also used for malware: over 31,000 malware samples, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, and njRAT, have accessed the group's domains. Moreover, some websites simultaneously displayed sports broadcasts to visitors and served as command and control servers for malware.
For example, the attackers acquired the domain cel-robox[.]com, previously owned by a desktop 3D printer manufacturer, and turned it into both a pirate streaming site and a command and control server for the Quasar RAT.
The report also notes that the group acquired former domains of projects belonging to such large companies as General Electric, Procter & Gamble, and Sony.
Researchers note that the attackers try to exploit the acquired domain reputation as quickly as possible: 24% of dropketch domains purchased by Sable Squirrel become operational on the day of registration, 76% within a week, and 94% within two weeks.
It is emphasized that Sable Squirrel is far from the only hacker group profiting from old domains. The company's analysts also monitorThe Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel groups control thousands of addresses and intercept traffic left over from previous owners. This traffic is typically redirected to advertising networks, fraudulent sites, and other cybercriminals.
Experts warn that domains with a good history can transform from trusted resources into part of a malicious infrastructure almost immediately after their registration expires and they are transferred to new owners.