Expired domains are a goldmine for hackers – and some cyber crime groups are investing millions in 'dropcatch' scams to deliver malware

Cyber criminals are spending millions buying up expired domains to repurpose them for malware, scams, illegal streaming, and online gambling, according to new research.

Taking advantage of the domains' trust, backlinks, and web traffic, they're not only being used by the original threat actors, but are also being sold on.

Domains originally registered years ago, dropped, and then acquired by someone else can still carry signals associated with their history. Researchers, security products, and reputation-based algorithms may view them more favorably than a genuinely brand-new registration.

This makes these re-registered 'dropcatch' domains a hot property for threat actors. Analysis conducted by Infoblox Threat Intel observed around 65,000 being registered per day during the first half of this year, representing nearly one-in-five of all newly observed domains.

"The sheer volume of dropcatch domains is astounding. We’ve known that bad guys buy expired domains to repurpose them, but the way in which they were used, and the amount of money actors are willing to spend wasn’t well understood.” said Renée Burton, VP of Infoblox Threat Intel.

"Expired domains can be a shortcut to both trust and traffic, making dropcatch domains a higher risk than the average newly-registered domain.”

Huge investment

One investigation uncovered a threat actor dubbed Sable Squirrel, estimated to have invested more than $7 million in acquiring over 10,000 expired domains now used for illegal streaming, online gambling, and malware distribution.

Most support a large Asian sports piracy operation whose sites look like consumer streaming products. These offer live football, match schedules, chat rooms, mirrors, and mobile promotion.

However, Infoblox said it's not the streaming that's the real business: it's the betting platforms that the group appears to control.

"A subset of these same domains also operate as malware C2. We identified over 31,000 malware samples connecting to Sable Squirrel domains, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, njRAT, and samples carrying HiddenTear ransomware signatures," said the researchers.

"In such cases, a human visitor sees a live football streaming site while an infected device uses the same domain as a control channel."

Meanwhile, other threat actors are taking over well-known malicious domains that are inserted into compromised websites. Researchers uncovered one actor delivering potential victims to SocGholish, the notorious 'fake update' infrastructure which was the target of Operation Endgame in June 2026.

Tracked as Shady Squirrel by Infoblox Threat Intel, the group delivered malware through scareware and call centers before partnering up with SocGholish’s operator TA569 in July.

"We see around 65,000 new dropcatch domains every day. Some of them are legitimate registrations picking up domains people are going to use for commercial or personal use. But an awful lot are grabbed for grey to black purposes," the researchers said.

"Any way you slice it, the risk posed by dropcatch domains is significant, arguably greater than that of newly registered domains."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.