Cybercriminals Exploit Expired Domains for Large-Scale Malware and Scam Campaigns

Hackers are acquiring expired domains to inherit their traffic and reputation, redirecting users to scams and malware. A threat actor named Sable Squirrel spent $7 million on dropcatch domains to support illegal streaming, gambling, and malware operations.

Threat actors are acquiring expired domains to inherit website traffic and reputation to redirect victims to scams and malware on a large scale.

DNS threat intelligence firm Infoblox has given the name dropcatch domains to those that get a second chance, where an expired domain becomes available for registration and is then snapped up by another party.

During the first half of 2026, 50,400

Read original article