Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware
Summary: Infoblox reports that 50,400 expired generic top-level domains were re-registered each day in the first half of 2026, rising to roughly 65,000 with country code domains, about one in five of all daily registrations. One actor it calls Sable Squirrel is assessed to have spent nearly $7 million on expired domains, hoards more than 10,000 of them, and runs illegal sports streaming, gambling promotion and malware command-and-control from the same infrastructure, with 31,000 malware samples communicating with it.
What you should know: Sable Squirrel is buying aged registration history, backlinks and residual traffic precisely because reputation-based defenses still read those signals as trustworthiness, and 76% of re-registered dropcatch domains go live within seven days. Education, IT and consulting, government, healthcare and banking have all been seen reaching malware command-and-control domains that also serve live streaming content.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026