Threat actors are increasingly buying expired “dropcatch” domains to hijack their inherited reputation, backlinks, and residual traffic for scams, gambling, and malware. Infoblox estimates that in early 2026 roughly 65,000 dropcatch domains were re-registered daily across generic top-level domains (gTLDs) and country code top-level domains (ccTLDs), meaning these registrations accounted for about one (1) in five (5) new daily domain registrations, with .net and .xyz leading the activity. These domains, often acquired via services like DropCatch, GoDaddy, and Namecheap, may still receive email, search traffic, and DNS queries intended for their previous owners, making them attractive and less suspicious to reputation-based defenses. A major actor dubbed Sable Squirrel has spent nearly $7 million amassing over 10,000 such domains to run illegal sports streaming and online betting brands (e.g., Xoilac, Cakhia) and to host command-and-control (C2) infrastructure for malware families like Quasar RAT, AsyncRAT, NanoCore, and Remcos. Other “scavenger” groups (Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel) control thousands more domains, reselling hijacked traffic to ad networks, tech support scams, initial access brokers, and zero click ad platforms. Many of the dropcatch domains are weaponized within days for malicious activities, underscoring the speed at which threat actors can operationalize infrastructure and be effective in accomplishing their goals.