Infoblox has published research on a threat actor it tracks as Sable Squirrel, which spent close to $7 million buying expired domains and controls over 10,000 of them.
Seven million dollars is a lot to spend on something you could register fresh for ten dollars each. The research explains why:
That money buys aged registration history, backlinks, residual traffic, and the kind of reputation signals many defenses still treat as indications of trustworthiness.
Reputation is the product
Nearly every layer of modern web defence has a domain-age or domain-reputation input. Newly registered domains get blocked, throttled, sandboxed or scored down — by mail filters, secure web gateways, DNS security products and browser safe-browsing lists.
That control works well against the obvious case and it is exactly what buying an expired domain defeats. A domain registered in 2009, with a decade of legitimate backlinks and residual traffic from people still linking to it, arrives pre-approved.
The names in the research make the point better than any explanation:
| Domain | What it used to be |
|---|---|
| healthymagination[.]com | A General Electric health initiative |
| maxfactor-international[.]com | A Procter & Gamble cosmetics brand |
| krogeralbertsons[.]com | The 2022 Kroger–Albertsons merger proposal |
| snsystems[.]com | Former Sony PlayStation developer tools |
| cel-robox[.]com | A 3D printer company |
Each of those carries years of inbound links from press coverage, partner sites and documentation. None of it transfers to the new owner's intent, and all of it transfers to the new owner's reputation score.
The scale of the market
This is not a niche.
During H1 2026, roughly 50,400 expired domains were re-registered daily in generic TLDs alone — 65,000 including country-code domains.
That is one-fifth of all new registrations.
Registrars by median daily volume: GoDaddy (5,246), Namecheap (4,385), DropCatch.com (3,568). Most abused TLDs: .net and .xyz ahead of .com.
The dropcatch market is legitimate and large. Sable Squirrel is a buyer in a functioning marketplace, not an intruder in it.
How fast they go live
- 24% live immediately
- 76% within seven days
- 94% within two weeks
Two weeks is the whole window. Any defensive process that reviews newly-acquired domains monthly is looking at infrastructure that finished its job before the review started.
What the domains do
Illegal sports streaming, online gambling promotion, and malware infrastructure.
31,000 malware samples communicated with Sable Squirrel infrastructure — Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos RAT and njRAT. All commodity remote-access trojans, all widely available, none of them sophisticated.
That is the shape of this operation: unremarkable malware behind unusually good infrastructure. The investment went into looking trustworthy rather than into the payload.
Geographically the actor centres on Vietnam, targeting users in South Korea, Japan, Taiwan, Singapore and Australia. Infoblox links it to Xoi Lac TV, an illegal streaming network dismantled by Vietnamese authorities in March 2026.
Related actors Infoblox tracks: Stuffy Squirrel (500+ domains, since 2020), Shady Squirrel (700+, since July 2023), Swiping Squirrel (3,000+, since 2022).
Why this matters more than it sounds
Illegal streaming reads like a low-stakes problem. The infrastructure question is not.
A defender's model of a malicious domain is usually: registered recently, no history, suspicious TLD, no legitimate backlinks. Every one of those signals is purchasable, and this research prices the purchase.
It also means the reverse test fails. "This domain has been registered since 2009 and used to belong to a Fortune 500 company" is not evidence of anything about who controls it today.
What to do
- Stop treating domain age as a trust signal on its own. Pair it with ownership change — a domain whose registrant, nameservers or hosting changed recently is far more informative than one that is simply old.
- Alert on re-registration of domains you used to own. Your expired marketing microsites carry your backlinks and, to a filter, some of your reputation. Someone can buy that.
- Inventory your own expiring domains. Campaign sites, acquired-brand domains, old product names. The GE and P&G examples in this research are what corporate domain hygiene failures look like from the outside.
- Watch the two-week window. 94% activate within it. Detection that operates on a monthly cycle is not detection here.
The uncomfortable framing: this actor did not defeat anyone's security. It bought its way past a heuristic, at market prices, from mainstream registrars.
