Infoblox Threat Intel's three-part "Dropcatch Domains" research series (published 2026-08-13, syndicated by SecurityAffairs, The Hacker News, IT Pro, and SC Media on 2026-08-14/15) documents an industrial-scale abuse of expired-domain re-registration ("dropcatching"): roughly 65,000 expired domains are re-registered daily in H1 2026 — nearly 20% of all newly observed domains — because expired domains retain backlinks, search-engine trust, cached traffic, and DNS history that criminals can immediately weaponize instead of building reputation from scratch.

The report attributes the largest single dropcatch operation to Sable Squirrel, a well-funded, likely transnational actor with a Vietnamese operational focus. Sable Squirrel controls more than 10,000 domains and has an extrapolated spend exceeding $7 million (confirmed: 160+ purchases, $430K+ documented) through GoDaddy, DropCatch.com, Namecheap, and Dynadot. Median domain activation is 5 days post-purchase, with 24% live same-day, 76% within a week, and 94% within two weeks. Premium acquisitions included brand-name domains with residual trust (healthymagination[.]com — formerly a GE health initiative; krogeralbertsons[.]com — the Kroger-Albertsons merger domain; maxfactor-international[.]com; veinteractive[.]com), alongside disposable lookalike domains seeded from Vietnamese football/streaming terms (xoilac, cakhia, 90phut, socolive, mitom, vaoroi).

The resulting platforms — branded Xoilac, Cakhia, 90phut, Socolive, and MiTom (secondary: ColaTV, Vaoroi) — are WordPress-based illegal sports-streaming sites geo-targeting Vietnam, South Korea, Taiwan, Singapore, Japan, and Australia, monetized through gambling/betting redirects (VSBet, ColaScore, 8xbet, 6686) behind cloaking/traffic-distribution infrastructure (6789x[.]site and similar). A subset of the same streaming domains double as live command-and-control infrastructure: Infoblox counted 405 confirmed malware C2 domains overlapping with the streaming footprint (peak 386 simultaneously active in December 2025) and 31,000+ malware samples. The malware timeline runs from early Quasar RAT testing (October 2025), through the first C2 configurations appearing on streaming domains (November 2025), a mass-weaponization wave covering ~86% of C2 domains (December 2025), sustained AsyncRAT 0.5.8 deployment (November 2025-March 2026, mutex lM9F7Ezcu9e3), to a DCRat surge of 7,610 samples in March 2026 that coincided with a Vietnamese law-enforcement crackdown (Xoi Lac TV site freeze February 2026; 30 suspects charged and ~300 billion VND / ~$12M USD seized in March 2026). Malware samples are explicitly self-branded with Windows PE metadata matching the streaming platforms (CompanyName "socoLIVE", FileDescription "xoilac client", ProductName "xoilac", trademarks referencing "8xbet", a Windows startup persistence key named "xoilac"), and telemetry shows exposure across 24+ industries, led by education (~20% of C2 queries) and IT/consulting (~14%), with government, healthcare, and banking sectors also affected. The highest-impact single C2/streaming domain was colatv88xb[.]cc, accounting for roughly 70% of exposed-network DNS queries. Evidence links Sable Squirrel to a broader Asian streaming-gambling ecosystem: shared live-chat code with Chinese-language comments on Chinese sports-betting sites, a shared image-serving backend (TheSports[.]com) used across Vietnamese, Chinese, Indonesian, and Russian-language gambling platforms, and the AiScore mobile app (10M+ Google Play installs) distributed by Hong Kong/Singapore-registered entities. Two documented incidents show Sable Squirrel infrastructure itself getting hijacked by third parties: xemlaibongda[.]net (Balada Injector-infected WordPress redirecting to a Keitaro-tracked BroPush affiliate chain) and xoilacxys[.]top (registrar-account takeover redirecting to a Russian investment scam before going lame).

A separate but related "Scavenger" cluster of three actors — Stuffy Squirrel (500+ domains, active since 2020), Shady Squirrel (700+ domains, active since July 2023, assessed Russian-speaking), and Swiping Squirrel (3,000+ domains, active since 2022) — specialize in acquiring expired domains that were previously compromised by other threat actors (TA2726, Magecart, Balada Injector) and immediately inherit the pre-existing infection/injection traffic without needing to re-compromise the underlying site. Stuffy Squirrel's current primary domain (gsstats[.]ru, active since November 2025, formerly weatherplllatform[.]com under Balada) runs a two-checkpoint cloaking chain (URL-path decoy serving Raphaël.js, then a 1,225-character self-removing IIFE gated by an independent TDS click-check) monetized first via PushHouse/ExoClick (through January 2025) and then ExoClick plus a Russian popunder network (from March 2025). Shady Squirrel (blacksaltys[.]com — formerly TA2726 infrastructure; plus simplejscdn[.]com, cdnjslibraries[.]com, imhd[.]io, pausewatchings[.]com, pills-europe[.]com, wesq[.]me, advanceslibrary[.]com, brodirect3s[.]site) runs custom JS injections behind Keitaro TDS with referrer-gated payload delivery, downstream to 1Win Russian gambling, a Japan/US-targeted tech-support scam (April-July 2026: phone numbers +1-201-409-2894 Japan-only, +1-877-481-2126, +1-888-756-6605; ~10,000 Azure static-webhosting accounts created monthly across 9+ regions; a 1x1-pixel beacon geolocates victims by IP/user-agent to select the delivered phone number; payload sections are AES-encrypted and decrypted client-side using the URL fragment as the key), and — most notably — SocGholish. Within roughly 10 days of Operation Endgame's June 2026 disruption of SocGholish infrastructure (300+ servers, 140+ domains seized, €41M frozen), Shady Squirrel registered advanceslibrary[.]com (2026-06-27) and began serving confirmed SocGholish fake-browser-update lures by 2026-07-10 (the domain was independently leaked in a Facebook post); the actor went silent again in early July 2026. Keitaro injection chains across Stuffy and Shady Squirrel share consistent tracking cookies ("0c9c8", "208c9") also previously observed with TA2726, and the two-part Keitaro injection pattern (config-name parameter to a Keitaro server, then localStorage-based campaign/subid/token retrieval) traces to a documented technique first seen with Help TDS in September 2020. Swiping Squirrel (blackshelter[.]org, bluegaslamp[.]org, draggedline[.]org, getshopstar[.]com, jqueryapihelpers[.]com, lzdatheme[.]com, slurpslimes[.]org, webpixel[.]app, windowlight[.]org) runs a distinct multi-stage cloaking pipeline (client-side fingerprint script -> index.php cloaker returning {} or "fw" -> /s/index/ relay -> /f/index affiliate-bid endpoint -> meta-refresh) funneling traffic to ZeroPark (Team Internet), AliExpress, and Kelkoo affiliate offers, with ClickFix malware observed downstream via the AdventureFeeds affiliate chain from ZeroPark.

Collectively, the four clusters demonstrate that expired-domain resale is now an organized, well-capitalized initial-access and C2 vector operating in parallel with (and largely orthogonal to) traditional vulnerability exploitation: no CVE applies, the abused surface is domain-lifecycle policy at registrars/registries, and both operational-security weaknesses (reused registrant contact details, a bogus Ho Chi Minh City business address, self-branded malware) and law-enforcement pressure (Vietnamese 2026 crackdown, Operation Endgame) have so far only produced brief dips before the operations resumed and expanded, reportedly gearing up around the 2026 FIFA World Cup streaming demand.