Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware
Infoblox finds dropcatch expired domains fuel malware delivery and C2, with actor Sable Squirrel spending ~$7M on 10,000+ domains.
58
Threat actor
Shady Squirrel
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenAug 16, 2026
- Last mentionedAug 16, 2026
Timeline
1 articles · newest firstAppears with
- Infobloxvendor · 1
- DCRatproduct · 1
- General Electricorganization · 1
- Remcos RATproduct · 1
- Swiping Squirrelthreat actor · 1
- GitLabvendor · 1
- Sable Squirrelthreat actor · 1
- Stuffy Squirrelthreat actor · 1
- watchTowr Labsvendor · 1
- SocGholishthreat actor · 1
- AsyncRATproduct · 1
- Quasar RATproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.