Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
Infoblox reports Sable Squirrel spent nearly $7 million on expired domains to redirect traffic to illegal sports streaming, gambling, and malware infrastructure.
Infoblox tracked 50,400 dropcatch domains re-registered daily in gTLDs during H1 2026, nearly 20% of all registrations, with .net and .xyz leading. The threat actor Sable Squirrel has acquired more than 10,000 expired domains supporting Asian sports piracy brands such as Xoilac, Cakhia, 90phut, Socolive, and MiTom while promoting betting services like VSBet, ColaScore, and 8xbet. The operation, assessed as Vietnam-based and overlapping the dismantled Xoi Lac TV streaming network, targets users in Vietnam, South Korea, Japan, Taiwan, Singapore, and Australia via a traffic distribution system, publishes Android apps through suspected compromised Google Play developer accounts, and deployed over 31,000 malware samples including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT, and njRAT.
- One in five daily domain registrations is a dropcatch domain
- Actor leverages inherited domain reputation to bypass trust-based defenses
- Promotion spans Facebook, Instagram, Reddit, Twitch, YouTube, and compromised job sites
- Compromised Play developer accounts resurface after Google suspensions
- Overlaps Xoi Lac TV, dismantled by Vietnamese authorities in March
- ATT&CK
- T1583.001 Acquire Infrastructure: DomainsT1568 Redirection to Malicious DomainT1566.002 Phishing: Spearphishing Link
- Threat actors
- Sable Squirrel
- Organizations
- Google PlayDropCatch.com
From the original article
8 min read at thehackernews.com
Threat actors are acquiring expired domains to inherit their website traffic and reputation with an aim to redirect victims to scams and malware on a large scale. DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available for registration and is then snapped up by another party.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.