Expired Domain Dropcatching Fuels Malware, Scams, and Illegal Streaming Networks

Infoblox Threat Intel reported that cybercriminals are increasingly exploiting expired "dropcatch" domains as a large-scale abuse channel, with roughly 65,000 re-registered dropped domains observed per day in the first half of 2026—about 20% of newly seen domains. Because these domains retain backlinks, reputation, residual traffic, and sometimes dangling DNS relationships, attackers can revive them for scams, traffic monetization, malware delivery, and redirection without first compromising new infrastructure. Researchers said actors including Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel collectively control thousands of such domains, using cloaked traffic distribution, ad-tech chains, affiliate programs, and custom injections to steer victims to tech-support scams, gambling offers, SocGholish, and other malicious content.

The most prominent operation, Sable Squirrel, was described as a sprawling network controlling more than 10,000 domains tied to illegal sports streaming, betting promotion, traffic redirection, and malware command-and-control, with estimated domain spending exceeding $7 million. Infoblox identified more than 31,000 malware samples communicating with Sable Squirrel infrastructure, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples with HiddenTear signatures, while some binaries carried the actor’s own brands such as socolive, xoilac, and 8xbet in PE metadata. Researchers said the actor repurposed hundreds of streaming domains into dual-use malware infrastructure beginning in late 2025, likely overlapping with the Vietnamese Xoi Lac TV ecosystem, and that related actors have also redirected visitors from major media sites and partnered with downstream malware operators such as TA569 after disruptions to earlier criminal infrastructure.