Threat actors are increasingly acquiring expired domains—known as "dropcatch domains"—to inherit their reputation and traffic, redirecting victims to scams and malware. According…
Sable Squirrel is a Vietnam-based threat actor that has spent nearly $7 million acquiring expired domains to build a criminal enterprise. It…
Stuffy Squirrel is a financially motivated threat actor active since at least 2020, controlling over 500 domains. It operates a traffic distribution…
Shady Squirrel is a Russian-speaking threat actor active since at least July 2023, controlling over 700 domains. It sends fraudulent traffic to…
Swiping Squirrel is a financially motivated threat actor active since at least 2022, controlling over 3,000 domains. It sends fraudulent traffic to…
SocGholish is a malware campaign that regained access to thousands of compromised sites by teaming up with Shady Squirrel shortly after its…
DropCatch.com is a custom drop catching service that tracks domains approaching deletion and automatically attempts to register them on behalf of customers.…
Infoblox is a DNS threat intelligence firm that published a three-part report detailing the abuse of expired domains by threat actors. It…