Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Introduction

Imagine visiting a website you trust — one with a familiar name and good reputation — only to find it redirecting you to a scam or infecting your computer with malware. This is happening on a massive scale, and hackers are spending millions of dollars to make it possible.

Cybercriminals are buying expired domains — websites that were once legitimate but were not renewed by their owners. These domains come with built-in trust, existing traffic, and search engine reputation. Hackers use this trust to redirect unsuspecting visitors to scams, malware, and illegal gambling sites.

What Are Dropcatch Domains?

When a domain expires and its owner doesn't renew it, it becomes available for anyone to register again. These are called "dropcatch domains" — domains that get a second chance at life under new ownership.

Key statistics:

• 50,400 dropcatch domains are re-registered every day in .com alone
• 65,000 when including country-code domains
• 1 in 5 new domain registrations is a dropcatch domain
• Most popular TLDs: .net, .xyz, .com, .org, .vip

Hackers use services like DropCatch.com, GoDaddy, and Namecheap to automatically register these domains the moment they become available. When multiple parties want the same domain, it goes to auction — and hackers are willing to pay big money.

How Hackers Use Expired Domains

Once hackers acquire an expired domain, they quickly weaponize it:

• 24% go live with malicious content the same day
• 76% are weaponized within 7 days
• 94% are active within 2 weeks

Why expired domains are valuable to hackers:

• Aged registration history — older domains appear more trustworthy
• Existing backlinks — other websites still link to them
• Residual traffic — people still visit the domain
• Cached search results — Google still shows them in search results
• Email reputation — email filters may trust them

Meet Sable Squirrel: The $7 Million Threat Actor

One of the most active threat actors using this technique is Sable Squirrel. According to security firm Infoblox, this group has spent nearly $7 million on expired domains.

What Sable Squirrel does:

• Operates illegal sports streaming sites (Xoilac, Cakhia, Socolive, MiTom)
• Promotes online gambling (VSBet, ColaScore, 8xbet)
• Runs malware command-and-control servers
• Hosts 31,000 malware samples including Quasar RAT, AsyncRAT, and Remcos RAT

The group uses a two-track domain model:

• Track 1: Expired domains (bought at auction) — used for legitimacy and reputation
• Track 2: Freshly registered lookalike domains — used for the streaming fleet

The Scavengers: Opportunistic Threat Actors

Infoblox has identified three other threat actors that buy expired domains to profit from residual traffic:

• Stuffy Squirrel (500+ domains): Redirects traffic to popunder ads and unwanted push notifications
• Shady Squirrel (700+ domains): Sends traffic to initial access brokers and tech support scams
• Swiping Squirrel (3,000+ domains): Redirects traffic to zero-click advertising platforms

These actors don't hack websites themselves. Instead, they "scavenge" the residual traffic from expired domains and redirect it to malicious destinations.

Famous Domains That Were Hijacked

Sable Squirrel has acquired some surprisingly well-known expired domains:

• healthymagination.com — a health initiative by General Electric (2009)
• maxfactor-international.com — a cosmetics brand owned by Procter & Gamble
• krogeralbertsons.com — created for a proposed merger that was later terminated
• snsystems.com — a former Sony PlayStation developer tools company
• rezilion.com — a now-defunct cybersecurity company (assets purchased by GitLab)
• cel-robox.com — a former 3D printer company (now used for both streaming and C2)

These domains had age, trust, and existing backlinks — making them perfect for malicious use.

How to Protect Your Business

What businesses should do:

• Monitor your domain expiration dates. Don't let your domains expire and fall into the wrong hands.
• Use domain reputation monitoring. Track if your domains are being used maliciously after expiration.
• Implement security awareness training. Teach employees to be cautious of redirects and unexpected pop-ups.
• Use DNS security solutions. Block known malicious domains and monitor for suspicious traffic.
• Monitor for brand abuse. Watch for lookalike domains that could harm your brand reputation.
• Consider domain backordering. If you have high-value domains, consider backordering them before they expire.

Final Thoughts

The Sable Squirrel operation shows that cybercriminals are investing serious money in building sophisticated criminal enterprises. $7 million is not a small amount — this is a professional operation with clear goals and multiple revenue streams.

Key takeaways:

• Hackers spent nearly $7 million on expired domains
• These domains inherit trust, traffic, and reputation from their previous owners
• Expired domains are used for illegal streaming, gambling, and malware distribution
• 50,000+ expired domains are re-registered every day
• Even well-known brand domains can be hijacked after expiration
• Monitor your domain renewals carefully

If you need help securing your domains or want to learn more about protecting your business from these threats, contact SystemLogicIT for a free security assessment.