Every day, roughly 50,400 domains across generic top-level domains expire and get re-registered by someone other than the original owner, a figure that climbs to about 65,000 when country-code domains are included, according to threat intelligence research from Infoblox. That’s not a small edge case. It represents around one in five of all daily domain registrations across those TLDs. Most of those “dropcatch” domains are unremarkable, small sites or forgotten side projects nobody misses. Some of them used to belong to real companies, and a threat actor Infoblox tracks under the name Sable Squirrel has turned buying those specific ones into a $7 million business.<\/p>\n
The reason an expired domain is worth anything to a criminal operation isn’t the name itself. It’s everything the name accumulated while someone else owned it: search engine reputation built over years, residual traffic from old bookmarks and links, cached search results still pointing at it, backlinks from other sites that never got updated, and sometimes email still addressed to the previous owner. Infoblox describes this directly: a re-registered domain comes with “a variety of lingering connections,” inherited trust signals a brand-new domain could never buy at any price. Sable Squirrel’s operation controls more than 10,000 of these domains, wired into sports-piracy brands (Xoilac, Cakhia, 90phut, Socolive, MiTom) and betting platforms (VSBet, ColaScore, 8xbet) aimed primarily at audiences in Vietnam, South Korea, Japan, Taiwan, Singapore, and Australia.<\/p>\n
The domains Infoblox identified as part of this specific operation aren’t random strings. They include healthymagination[.]com, a former General Electric health initiative domain; maxfactor-international[.]com, once tied to Procter & Gamble’s cosmetics brand; krogeralbertsons[.]com, connected to the grocery chains’ merger; snsystems[.]com, formerly Sony PlayStation developer tooling; rezilion[.]com, a cybersecurity firm whose assets GitLab acquired; and cel-robox[.]com, a former 3D printer company’s domain now doing double duty as both a piracy streaming site and malware command-and-control infrastructure. Every one of those domains carried real, earned reputation from a legitimate business before it lapsed.<\/p>\n
Infoblox’s data shows this isn’t a slow process. Almost a quarter of re-registered domains, 24%, go live with new content the same day they’re caught. Three-quarters, 76%, are active within a week. Ninety-four percent are operational within two weeks. There’s essentially no window between a domain lapsing and someone putting it to use; automated “dropcatch” services and backordering systems exist specifically to compete for these domains the moment they free up, sometimes running competitive auctions among multiple interested buyers within hours of expiration.<\/p>\n
Once live, the redirection techniques are deliberately hard to spot from the outside. Traffic distribution systems route legitimate visitors toward betting platforms. Cloaking chains send unintended audiences to dead-end pages instead of the actual payload, so a casual check of the domain looks harmless. Some domains, like the one Infoblox calls “6789x[.]site,” route users differently depending on their geographic location, and serve different content to bots than to humans specifically to hide the operation from automated security scanners. Infoblox also found 31,000 distinct malware samples, including well-known remote-access trojans like Quasar RAT, AsyncRAT, DCRat, NanoCore, and Remcos RAT, that have communicated with infrastructure tied to these domain operations. Victims identified across education, IT consulting, government, healthcare, and banking sectors reached that malware infrastructure through what looked, on the surface, like an ordinary streaming or content site.<\/p>\n
Infoblox’s research names the registrars where the highest daily volume of dropcatch domains actually gets re-registered: GoDaddy (a median of 5,246 dropcatch domains daily), Namecheap (4,385 daily), and DropCatch.com itself (3,568 daily), a service purpose-built for competitively re-registering expiring domains through automated backordering. That volume reflects the overall size and market share of those registrars more than it implicates any of them individually in wrongdoing, but it’s a useful reminder that the mechanics enabling this, fast, automated, low-friction domain re-registration, are the same mechanics that make registering a new domain quick and easy for anyone.<\/p>\n
The obvious lesson, don’t let your own domains expire by accident, is real but incomplete on its own. The less obvious one is that an old, retired domain your business no longer uses, an acquired brand, a discontinued product line, a rebrand’s former name, is exactly the kind of asset this research shows criminals specifically hunt for, precisely because it still carries reputation and inbound links your current site doesn’t have yet. Businesses often let those old domains lapse deliberately once they stop using them, without realizing that’s the moment they become someone else’s infrastructure instead of just disappearing.<\/p>\n
A few concrete habits follow directly from how this operation works. Keep every domain your business has ever used, current or retired, on auto-renewal with payment details that don’t go stale, rather than assuming an unused domain is safe to abandon. Enable registrar-level locking to prevent unauthorized transfers, and use multi-factor authentication on the registrar account itself, since account compromise is a faster path to hijacking than waiting for an expiration date. If a domain genuinely has no future use to your business, redirect it to your current site or park it with your registrar rather than letting registration lapse, since a domain you deliberately release is functionally identical, to a buyer like Sable Squirrel, to one you forgot about. If you’re registering a new domain for your business, using a straightforward domain registration service<\/a> that makes auto-renewal and locking simple by default removes one of the easiest ways this kind of hijacking happens in the first place.<\/p>\n It’s worth separating this from a more familiar threat, typosquatting, where someone registers a misspelled variant of a live brand’s domain (like “amaz0n.com”) to catch mistyped traffic. Dropcatching is a different mechanism entirely: the domain isn’t a lookalike, it’s the real, previously legitimate domain, re-registered the moment the original owner stops paying for it. That means standard trademark-based defenses built for typosquatting, watching for confusingly similar new registrations, don’t catch this at all, because there’s nothing confusingly similar about a domain a company used to own outright. The only defense that actually works is not letting the domain lapse in the first place, or catching the re-registration within the same narrow window the criminals are working in.<\/p>\n For a business picking up a domain with any prior history, whether it’s a rebrand target, an acquisition, or just a name that happened to be available, a few quick checks catch most of the obvious risk before it becomes your problem. Run the domain through the Wayback Machine to see what it was previously used for and by whom. Check current blocklist and reputation services to confirm it isn’t already flagged for spam or malware distribution, since that reputation, good or bad, transfers to whoever registers it next. Search the domain name alongside terms like “scam,” “phishing,” or “malware” to catch recent coverage a reputation checker might not have indexed yet. None of these take more than a few minutes, and all three would have flagged several of the domains in Infoblox’s report before a legitimate business risked building anything on top of them.<\/p>\n The broader pattern behind all of this is that domain reputation is a real, transferable asset, valuable enough that a criminal operation will spend seven figures acquiring it deliberately. Treating an old, retired, or about-to-expire domain with the same care as an active one, rather than as something that quietly stops mattering once a business moves on, is the cheapest insurance against becoming raw material for someone else’s infrastructure.<\/p>\nHow this differs from typosquatting, and why the distinction matters<\/h2>\n
A short checklist before registering any domain that isn’t brand-new<\/h2>\n