Sable Squirrel Spent $7 Million on Expired Domains Through GoDaddy and DropCatch to Build a Malware Empire
Sable Squirrel has spent about $7 million buying expired domains and turning their leftover trust, traffic and backlinks into infrastructure for illegal streaming, gambling promotion and malware.
The unsettling part is that many of these domains once belonged to legitimate organizations, so the danger can arrive wearing a digital reputation it didn’t earn.
The deeper story is what happens after a domain expires, because search engines, security tools, old links and even forgotten software connections may keep treating the address like the same familiar place.
➜ The real story: Domain reputation is becoming something cybercriminals can buy, and that means “old” no longer automatically means “safe.”
The good news is that defenders can adapt, but only if they stop treating registration age as a shortcut for trust.
How Sable Squirrel Uses GoDaddy, DropCatch and Expired Domains to Inherit Trust
The operation controls more than 10,000 domains and uses two basic tactics: fresh lookalikes and expired domains purchased through services including GoDaddy, DropCatch, Namecheap and Dynadot.
The expired names are the valuable part because they can arrive with years of registration history, backlinks and residual visitors already attached.
Roughly 65,000 expired domains are re-registered each day across generic and country-code extensions, making this less of a weird edge case and more of a huge secondary market.
About 24 percent of the tracked purchases were activated the same day, and 94 percent were live within two weeks.
Why Quasar RAT, AsyncRAT and DCRat Make Old Domains a Malware Problem
More than 31,000 malware samples have been linked to domains in the operation, including Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos and njRAT, along with samples carrying HiddenTear ransomware signatures.
Some domains can show a normal-looking sports streaming site to a person while also functioning as command-and-control infrastructure for infected devices.
That puts this campaign squarely inside the wider mix of malware, drive-by attacks and DNS abuse covered in Spacelab’s biggest cybersecurity threats right now. It also shows why a familiar-looking URL should never get a free pass just because it has history.
What Businesses Should Learn From the Sable Squirrel Expired Domain Strategy
The practical fix starts before a domain is abandoned.
Companies should inventory old domains, retire lingering DNS records, remove forgotten links and integrations, and keep strategically important names registered when the risk of reuse is high.
Security teams also need signals beyond domain age, including current ownership, DNS behavior, hosting changes and sudden shifts in traffic patterns.
That same mindset applies to phishing campaigns built from real contextual data: trust should come from what a site or message is doing now, not what it used to be.
FAQs
What Is Sable Squirrel?
Sable Squirrel is a cybercrime operation linked to more than 10,000 domains used across illegal sports streaming, gambling promotion and malware infrastructure.
Why Are Expired Domains Dangerous for Cybersecurity?
Expired domains can keep old backlinks, residual traffic, search visibility and reputation signals. If a malicious buyer acquires one, that inherited trust can help scams or malware look more legitimate.
Which Malware Families Have Used Sable Squirrel Domains?
Linked samples include Quasar RAT, AsyncRAT, DCRat, NanoCore, Remcos and njRAT, along with samples carrying HiddenTear ransomware signatures.
