Even dead websites aren

TechRadar Published Aug 21, 2026 Reviewed Aug 21, 2026 ✓ Reviewed by citations.press editors

Infoblox counted an average of 50,400 dropcatch domain re‑registrations per day across generic top‑level domains in the first half of 2026, rising to roughly 65,000 when country‑code domains are included.

50400 per day · re-registrations65000 per day · re-registrations Infoblox, threat intelligence research

Infoblox reported that close to a fifth of all daily domain registrations were dropcatch re‑registrations in the first half of 2026.

about 0.2 fraction · dropcatch re-registrations Infoblox, threat intelligence research

Infoblox found that nearly three in ten newly observed .net and .xyz domain names had a previous life, while 24.5% of newly observed .com names had a previous life.

0.3 fraction · .net and .xyz domain names0.245 fraction · .com domain names Infoblox, threat intelligence research

Infoblox identified an entity named Sable Squirrel that controls more than 10,000 domains, most of which support a large Vietnamese-language sports piracy operation.

more than 10000 domains · Sable Squirrel domains Infoblox, threat intelligence research

Infoblox estimates that Sable Squirrel spent north of $7 million on expired domains, the largest domain acquisition budget identified for a single actor in the industry.

more than 7000000 USD · expired domain spend Infoblox, threat intelligence research

Infoblox identified more than 31,000 malware samples that called back to Sable Squirrel's infrastructure, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, and njRAT, as well as samples carrying HiddenTear ransomware signatures.

more than 31000 samples · malware samples Infoblox, threat intelligence research

Infoblox confirmed 405 domains as malware command-and-control, roughly four percent of the total domains it controls.

405 domains · malware C2 domainsroughly 0.04 fraction · malware C2 domains Infoblox, threat intelligence research

Vietnamese authorities froze some of Sable Squirrel's flagship sites in February 2026 and charged 30 suspects in March 2026.

30 suspects · charged suspects Vietnamese authorities, law enforcement

Vietnamese authorities seized assets worth roughly $12 million from Sable Squirrel.

roughly 12000000 USD · seized assets Vietnamese authorities, law enforcement

A domain name is the closest thing the web has to a credit history: age, inbound links, search visibility, and reputation all feed the reputation scores that security products consult before deciding whether a request is worth worrying about.

New research from Infoblox Threat Intel claims this history has become a commodity with a market price, and that at least one criminal operation has been buying it in bulk.

The study, published as a three-part series, focuses on what the industry calls dropcatch domains: names that lapsed, were released back to the registry, and were then re-registered by someone else entirely.

Dropcatch domains aren't new; software has been primed to spot expiring domains for years, and it sometimes snags the occasional massive win for users who deploy such solutions.

This lets users start with domains that already have history that benefits them or flip certain domains for a price that is often a multiple of the domain's original purchase price.

Infoblox counted an average of 50,400 such re-registrations a day across generic top-level domains in the first half of 2026, rising to roughly 65,000 once country-code domains are added. That amounts to close to a fifth of all daily registrations. The rate is highest on .net and .xyz, where nearly three in ten newly observed names had a previous life, with .com behind them at 24.5%.

The problem is that not all of these are seemingly innocent or small-scale scalping operations: Infoblox has identified an entity it has labeled Sable Squirrel, part of a naming convention the company applies to domain hoarders. It controls more than 10,000 domains, most of which support a large Vietnamese-language sports piracy operation operating under brands including Xoilac, Cakhia, 90phut, Socolive, and MiTom.

Infoblox estimates the actor's total spend on expired domains at north of $7 million, which it describes as the largest domain acquisition budget it has identified for a single actor in the industry. The bigger problem is that Infoblox also found that a subset of these streaming domains runs as malware command and control while continuing to serve live football to human visitors.

More than 31,000 samples identified called back to Sable Squirrel's infrastructure, spanning Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos, and njRAT, plus samples carrying HiddenTear ransomware signatures.

Infoblox said the operator's carelessness made finding a link easier: many samples carry the actor's brand names in their Windows executable metadata, with fields reading socolive, xoilac, and 8xbet. Infoblox confirmed 405 domains as malware C2, which is roughly four percent of the total domains the organization controls, and the weaponization arrived as a single wave in late 2025 rather than as the operation's original purpose.

Sable Squirrel's core business is gambling, and while the entity tries to mask it as a streaming operation, it also doubles as an acquisition channel for the same. While law enforcement has not been silent here, it has had limited luck at best: Vietnamese authorities froze some of the flagship sites in February 2026 and charged 30 suspects in March.

They also seized assets Infoblox puts at roughly $12 million, but it seems to have survived and continues to expand, having acquired and run World Cup-centric domains since June, further expanding its footprint in a world where it has already identified and secured a large chunk of what is arguably a very important commodity: Domain authority.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Rahim Amir is a UAE-based tech writer who enjoys building PCs as much as he enjoys writing about them. He has been professionally writing about PC hardware since 2023, focusing on buyer’s guides, hardware reviews, and sponsored content and features related to tech.

Having built hundreds of gaming PCs and being an avid gamer in his spare time, Rahim tends to have stronger opinions about hardware than most. This is particularly on display when he gets his way with powerful, but minimalistic RGB builds even as Small Form Factor (SFF) PCs come a close second.

Please logout and then login again, you will then be prompted to enter your display name.

This article was originally published by TechRadar ↗. citations.press indexes the source-backed facts above and links to the original. Something wrong? Corrections policy · Report an error