A set of actors, including Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel, operate by inheriting infection traffic from compromised domains rather than buying new ones, with Shady Squirrel linked to SocGholish and tech support scam networks.

Three scavenger actors exploit already compromised domains to inherit infection traffic, demonstrating varied malicious use cases beyond purchasing new domains.

Domain reactivation happens rapidly, with about a quarter going live the same day, three-quarters within a week, and most within two weeks, as attackers aim to capture traffic before security assessments update.

Expired or dropcatch domains are re-registered daily and accounted for roughly 20% of new registrations in early 2026, often carrying history, traffic, and DNS signals attackers can leverage.

Domain age and reputation aren’t inherently trustworthy; new ownership can alter risk, so defenders should reassess domains with inherited history rather than assume safety.

This piece is part of a broader research series that will continue to explore more cases of expired domains used for malicious purposes.

The report draws on Infoblox Threat Intelligence, with summaries from SecurityAffairs and Pierluigi Paganini, and references additional related posts and studies.

Dormant domains like healthymagination.com and rezilion.com have been repurposed by attackers, showing how defunct legitimate brands can be weaponized through dropcatch.

Expired domains retain residual value—backlinks, lingering emails, cached search results, and DNS records—that can aid threat actors in delivering malware or directing traffic before defenses catch up.

A threat actor dubbed Sable Squirrel spent nearly $7 million on expired domains to run illegal streaming and gambling promotions, while hosting malware C2 servers for multiple RAT families across over 10,000 domains using branded lure sites.