Crooks Are Buying Your Expired Domains and Using Them to Deliver Malware
Infoblox finds dropcatch expired domains fuel malware delivery and C2, with actor Sable Squirrel spending ~$7M on 10,000+ domains.
Infoblox Threat Intel reports that in H1 2026 dropcatch (re-registered expired) domains made up nearly 20% of all new registrations, about 65,000 per day, inheriting reputation and traffic that attackers exploit. Threat actor Sable Squirrel spent nearly $7 million on 10,000+ expired domains, running Vietnamese, Korean, Japanese and Australian streaming platforms (Xoilac, Cakhia, 90phut) that double as C2 servers for Quasar RAT, AsyncRAT, DCRat and Remcos RAT. Scavenger actors like Shady Squirrel acquire previously compromised domains and feed inherited traffic to SocGholish and tech support scam networks.
- ~20% of new domains in H1 2026 were dropcatch; .net and .xyz highest at ~30%
- Sable Squirrel streaming brands double as C2 for Quasar, AsyncRAT, DCRat and Remcos RAT
- Shady Squirrel (Russian-speaking, active since 2023) feeds traffic to SocGholish and tech support scams
- Acquired domains include GE's healthymagination.com and cybersecurity firm rezilion.com
- 24% of acquired domains go live within 24 hours; 94% within two weeks
- Vendors
- InfobloxwatchTowr LabsGitLab
- Organizations
- General Electric
- Countries
- VietnamSouth KoreaJapanAustralia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | healthymagination.com | . Among the expired domains Sable Squirrel has acquired are healthymagination.com, originally a General Electric health initiative, and rezil |
From the original article
4 min read at securityaffairs.com
Attackers are buying expired domains to exploit their reputation, traffic and DNS history, using them for malware delivery, scams and C2 infrastructure. Every day, roughly 65,000 domain names that once belonged to someone else get re-registered by a new owner.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.