Dropcatch actors inherit traffic from compromised websites by acquiring expired malicious domains and redirecting victims to scams and malware.
Infoblox Threat Intel | Dropcatch series | Part 3 of 3
Executive Summary
Purchasing expired domains from legitimate companies is a well-known threat actor trick. By acquiring these domains, a practice called dropcatch, they gain the reputation of the original owner. In our companion blog, we introduced a threat actor who has spent massive amounts of money doing exactly this to prop up their malware and gambling operations. But there’s another class of dropcatch actors who repurpose malicious domains. It’s surprising at first, but it actually makes sense. Here’s why.
Every year, tens of thousands of websites are compromised, leading hapless visitors to a wide variety of scams and malware. Some of the most pernicious threat actors, like SocGholish and ClearFake, use these sites to steal user credentials and sell them to others for further exploitation. These compromised sites typically contact an actor-controlled domain for a routing decision of the potential victim. When those domains expire and go unclaimed, the requests do not stop; they simply go unanswered.
Why let a good compromise go to waste? For the threat actors we describe in this blog, that gap—the dropped domain—is a business opportunity. Instead of compromising websites themselves, these actors acquire expired domains and immediately begin receiving traffic from the infection chains their predecessors left behind. Then they inject their own content. They are in effect, scavengers.
What you will learn here is that the nature of the scavenger varies. They all fraudulently acquire traffic and resell it to affiliate programs, but the way in which they do so, and the impact to users varies widely. There’s nothing in plain sight. These financially motivated actors have gone unnoticed because they obfuscate their operations, both in their scripts and in server-side cloaking. One actor sells to a large global media commerce platform, another sells to advertising networks most people won’t recognize, and the third sells traffic to big name cybercriminals like SocGholish.
They co-exist on many compromised websites, operating in a race condition to grab the potential victim. Often domains pass from one of these actors to another over time. Between the three actors highlighted here, they own thousands of domains embedded in tens of thousands of compromised sites. Despite their widespread presence, to our knowledge, none of these have been discussed before.
This blog covers three of the dropcatch actors we have been tracking via DNS, along with their ecosystem (Figure 1):
- Stuffy Squirrel is a specialist in stuffing their malicious activity into legitimate scripts
- Shady Squirrel partners with initial access brokers and enabled a large-scale return by SocGholish less than a month after disruption by Operation Endgame. Research led to several discoveries, including a tech support actor, a previously unpublished two-part Keitaro injection chain, and an unusual Help TDS infection vector
- Swiping Squirrel, the most prolific of the bunch, sends their fraudulent traffic to zero click advertising platforms which is resold and often ends at scams or malware
Figure 1. The dropcatch actors and ecosystem covered in this paper
The Scavenging Model
There is a surprising amount of dropcatch acquisition of “known bad” domains. Security companies—like us—sometimes acquire malicious domains to collect telemetry about compromised hosts. But we have uncovered several actors who grab expired malicious domains so they can repurpose them. As far as we can tell, these actors monitor compromised websites, just like the security industry does, and when the domain expires, they swoop in to claim it. Once they own the domain, without hacking anything, they redirect users to their own scams or malware. A domain that is embedded in thousands of old sites can make the rounds through several threat actors all through dropcatch or variations of it.
We originally referred to this class of actors as “Thieves’ Thieves” because they grab traffic from other criminals, but really, they are opportunistic scavengers. Aside from purchasing expired malicious domains, we have found that they often coexist on a compromised site. The result is a race to acquire victims: the same compromised domain may be redirected by different dropcatch actors depending on website visitor characteristics, timing, and other factors. We use squirrels for threat actors that are domain hoarders. The three actors we will describe here are full of mischief and thievery you expect from the clever animals you contend with in your own backyard. They are indeed scavengers.
Stuffy Squirrel
True to their name, Stuffy Squirrel is a specialist in hiding malicious activity inside legitimate scripts. The actor has been continuously active since at least 2020 and has operated a traffic distribution system (TDS) across three generations of dedicated infrastructure. They sell traffic to specific affiliate advertising networks. The website visitor may end at a scam, unwanted content, or a decoy.
They have maintained the same publisher account identifier across all of them—evidence of a single, persistent operator. The infrastructure consists almost entirely of dropped domains that once served malicious infrastructure for various actors, including TA2726, and actors running Magecart and Balada injection campaigns. We have identified over 500 domains controlled by this actor.
Evading Detection
Stuffy Squirrel evades detection through two independent server-side checkpoints, either of which can stop the chain before any malicious activity is visible. These techniques have kept them in business for the last six years. See Figure 2 for a depiction of how this actor operates; details of these steps follow.
Figure 2. The event chain for Stuffy Squirrel
The first check comes when a victim loads the compromised page. The live payload is served only when the incoming request matches the specific URL the original attacker left behind in the victim site’s code. Any other request—a scanner probing the actor’s dropcatch domain directly, a path that was never previously embedded in a victim page—receives a decoy instead. The decoy is a legitimate and widely used Scalable Vector Graphics (SVG) mathematics library, Raphaël.js.
The live payload is the same filename but with a 1,225 character Immediately Invoked Function Expression (IIFE) inserted that executes when the script loads and removes itself from the page when finished. To a scanner, both files look like Raphael.js. The difference is invisible until the IIFE runs.
The second check occurs when the payload attempts to call the actor’s popunder advertising gateway. Even when the browser passes the first check and the IIFE executes, the TDS evaluates each incoming request independently and doesn’t always respond. We have seen instances where the payload executed and no popunders were served. This is due to a third layer of evasion that sits beyond both server-side checks: the popunder windows only open on a real user click. Even when both checks pass and the ad delivery platform loads successfully, nothing happens until the visitor interacts with the page. Automated scanners execute scripts but do not click, so the final delivery stage—the popunder windows and everything downstream of them—remains completely invisible to automated analysis even when the full chain is active.
All three checks operate independently.
Inside the Injection
Stuffy Squirrel’s presence on a compromised site is split into two components. The first is a script server: a dedicated domain hosting the actor’s malicious JavaScript that loads when a user visits the site. The history of these domains illustrates the layers of the scavenging model. The domain weatherplllatform[.]com was previously used as Balada injector infrastructure, infecting thousands of WordPress sites during the campaign’s peak and was Sucuri’s second most-blocklisted resource in 2022. The domain magesource[.]su was previously used as a Magecart card-skimming domain targeting compromised Magento stores to steal payment card data. In both cases, Stuffy Squirrel inherited not just the domain but the entire well-established victim pool that came with it.
The first script acts as a remote JavaScript loader dynamically building a script element and loading from another actor-controlled domain. This second domain coordinates the popunder delivery chain, routing victim traffic to an advertising exchange where it is auctioned in real time. Since November 2025, gsstats[.]ru has served as the actor’s current primary entry point, replacing tofuturepubs[.]com, which was used throughout 2024 and 2025. The second part of the process is done over several calls to the same entry point. The victim’s URL is encoded and passed it to the server, which then triggers the popunder delivery chain after user interaction, handing the visit to an ad exchange. The primary script also features an error-reporting mechanism: if the domain is unreachable within five seconds, the script uses a tracking pixel and sends an HTTP request back to the script server domain, notifying the operator. If downstream ad delivery fails, the server receives an immediate callback reporting the failure, allowing the actor to monitor its own delivery pipeline in real time.
Monetization Methods
Stuffy Squirrel has consistently monetized their operations through affiliate advertising platforms. These platforms operate in several verticals but are dominated by adult content. Other verticals we’ve seen include e-commerce affiliate fraud and online gambling. We’ve organized the actor’s affiliate network activity into two phases based on observed shifts in platform preference.
Phase I: PushHouse and ExoClick
- Through January 2025, the actor operated as a publisher in the PushHouse network, a company known for popunder and in-page push notification ad delivery. The actor also simultaneously ran ExoClick popunder ads, routed through actor-controlled TDS domains to ExoClick’s delivery infrastructure.
Phase II: ExoClick and an unknown Russian popunder network
- Since March 2025, the actor has continued to publish for ExoClick while migrating from PushHouse to a Russian popunder advertising network. It is likely that this is a commercial affiliate advertising network. This network has cycled through multiple backend domains, all white-label deployments of the same underlying ad platform sharing the actor’s persistent publisher ID. When triggered, the platform opens popunder windows which route visitor traffic through an advertising exchange and ultimately delivers it to the destination. ExoClick delivers its own popunders through a parallel channel simultaneously, confirming both systems remain active at the same time on the same compromised page.
Shady Squirrel
While the financial fraud of Stuffy Squirrel might not seem that serious, Shady Squirrel is a totally different matter. You aren’t going to find this character showing their true colors via open-source scanning sites. Their malicious behavior is only triggered when the URL visited contains a specific referral record. Even then, victims must pass through a multi-step cloaking filter before any malicious content is served. The Russian-speaking actor operates a TDS grounded in domains that linger within compromised websites. They use custom JavaScript injections, as well as Keitaro, and server-side fingerprinting. If a bot or scanner is detected, the original page will be shown.
For a long time, we tracked their activity but weren’t sure of the purpose. That all changed in June when Randy McEoin saw that an old TA2726 domain was serving up tech support scams—the nut cracked open. A few weeks later, Randy uncovered a real surprise: Shady Squirrel was sending traffic to the notorious threat actor SocGholish. Suddenly, Shady Squirrel went from “really interesting” to “crazy interesting.” And this is why we believe collaboration is key to success in cybersecurity.
Shady Squirrel has operated since at least July 2023. In 2026, they sent traffic to four downstream actors: a Russian gambling platform called 1Win; a tech support scam actor; the original fake update actor, SocGholish; and a Keitaro server. The Keitaro injections operate in an unusual manner; more about that later.
To make it through the TDS gates to a final payload (aka “money page” or “black page”), the URL must include a specific referrer string. In the 1Win case, an internal referral is used to load a sticky on-page gambling banner. The redirects in the tech support scams and SocGholish require the referrer to be a search engine. Even then, most visits will end up at the original website. Figure 3 shows an overview of payload routing.
Figure 3. Payload routing for Shady Squirrel; when the compromised page is scanned or visited directly, no action will occur
We have identified over 700 domains acquired by Shady Squirrel since 2023. While they do freshly register some domains, their portfolio is primarily composed of dropcatch domains previously operated by other threat actors and left dormant on compromised sites before being reactivated for Shady Squirrel infrastructure. These include domains previously operated by malware actors like TA2726 as well as affiliate advertising platforms. In one high profile case, they snagged a legitimate domain that was used in cookie consent; a clever supply chain hijack. The domains they have purchased or otherwise acquired include:
- blacksaltys[.]com (formerly TA2726)
- simplejscdn[.]com (formerly used by affiliate of commercial push notification service)
- brodirect3s[.]site (formerly commercial push notification service)
- wesq[.]me (formerly commercial push notification service affiliate)
- imhd[.]io (formerly a legitimate CDN)
Figure 4 depicts the actor’s domain acquisition trends. The values are estimates based on the domains we have been able to confirm. Shady Squirrel’s activity appears to be run-of-the-mill arbitrage until early 2025 when they begin injecting calls to a Keitaro server. Later in 2026, they use the same style to make custom injections.
Figure 4. Estimated cumulative growth of Shady Squirrel’s domain stash. Each month indicates the number of actively controlled domains at that time.
While Shady Squirrel primarily gains access to sites through existing compromises, we have seen direct injection of their scripts into several sites. In one July 2026 example, we saw two different styles of injections, both belonging to the threat actor, appended to legitimate themes files used by the website. This would indicate that they are either in the WordPress exploitation game themselves or have affiliates using their scripts. In these cases, they are using newly registered domains instead of dropcatch ones.
There are a few versions of their bespoke injection scripts. We believe the injections are primarily used to drive traffic to tech support scams, though in the past they also sent traffic to affiliate marketing networks. In some cases, a newly created domain is used for a Keitaro injection for some months and then begins serving the custom injection. The reason for this isn’t clear. We’ll start with their affiliation with initial access brokers and then come back to the Keitaro servers.
The Tech Support Scam Actor
Because Shady Squirrel is resistant to scanning, we confirmed the browser lock operation on a research machine and analyzed the resulting packet capture. Redirection only occurred when the site visit came from a search engine, and when the device was running the Windows operating system. A series of pop-up windows filled the screen with warnings that the machine had been hacked, and that the user needed to dial Microsoft support at a specific phone number; see Figure 5.
Figure 5. Screenshot of the false tech support alarm targets Japanese and U.S. residents
While it is difficult to find evidence of Shady Squirrel redirections in open-source tools, there are many scans for the tech support scam actor. The word scam here is misleading. These actors use live call centers to convince people to install remote access tools, giving them full control of the machine. It’s a lot worse than buying an unnecessary antivirus subscription. From that point, the actor can steal credentials and sell them to others for a variety of uses, including enterprise data breaches. The campaigns we are tracking were first seen in April 2026. They only target victims in Japan and the United States.
Figure 6 shows an overview of the complete attack from the compromised site injections to the tech support alerts. When the malicious site is reached, it quickly redirects to load a static HTML page with a random filename. A 1×1 pixel image is fetched to capture the visitor’s IP address and user agent information. The IP address is used to determine which phone number to display, and likely to credit the publishing affiliate for the visit as well.
Figure 6. The attack chain from Shady Squirrel to a Windows machine compromise through the affiliated tech support actor
Figure 6 excludes a connection to a second domain, which returns the call center phone number. We probed this second set of domains from various locations and user agents to identify active call centers. Our experiment revealed three numbers, all routed to the United States:
- (201) 409-2894 (seen for Japanese targets only)
- (877) 481-2126 (toll free)
- (888) 756-6605 (toll free)
A specific URL format identifies the affiliate. When we probed the domains directly, e.g., renpaste[.]top, it returned “fuck you pig.” In other public scans, renpaste[.]top claims to be a “snippet hosting service,” i.e., a service to host configs via links. Indeed, that is what it does. Since April, we have observed nine phone number server domains.
The HTML content is a bit of a mystery. It contains an AES-encrypted section that is decrypted client-side using the URL fragment as the key. However, we never captured a URL containing that fragment, and the scam content loads regardless of decryption. The payload page is reached via a client-side navigation triggered by an initial request to the parent directory. And that directory-level response is exactly the kind of fast, small reply that scanners are known to miss. Perhaps there is a fragment passed in some cases that would decrypt the blob; we just aren’t sure.
As of early July, that unknown technical support scam actor has gone silent. Before that, the thief abused Microsoft Azure static webhosting to serve lures, creating nearly 10k accounts a month across at least nine regions globally. Each site was short-lived. We suspect this actor had multiple affiliates but can’t confirm. From our observations, Shady Squirrel seemed to be their largest source of traffic. It makes sense: Shady Squirrel takes advantage of thousands of long-compromised websites to identify potential victims, whereas the other affiliates appear to be creating new traffic sources.
Right when Shady Squirrel stopped sending traffic to the tech support scam actor (and in fact we saw no more activity related to that actor anywhere), we saw them begin to send traffic to SocGholish.
SocGholish
Our original plan was to trigger the tech support scam, call the number, and record the conversation. We could use the data captured during that experience to understand what technique they use to get into victims’ machines. We started with a Google search result for a compromised domain (Figure 7). But this was before we uncovered the shift away from the tech support scam, so when we went to make the call, we were redirected to a fake update instead! See Figure 8. Not surprisingly, the update was identified as malware. The next day, Randy McEoin validated the path as SocGholish.
Figure 7. Screenshot of the lure used to trigger the Shady Squirrel redirection to SocGholish found via Google search run in mid-July 2026
Figure 8. Screenshot of a SocGholish fake update delivered via Shady Squirrel on July 10, 2026
At that point, the Shady Squirrel story became even more interesting. SocGholish had been disrupted by Operation Endgame, a joint law enforcement and industry action, less than a month earlier, in mid-June 2026. Over 300 servers and 140 domains were seized or cleaned during the event, and cryptocurrency assets totaling more than $41million Euro were frozen. Actions like these are impactful but unfortunately also temporary. The question is always how quickly the actor will recover and what will they do next? In this case, we now know they partnered with Shady Squirrel, regaining access to tens of thousands of compromised sites effortlessly about 10 days later.
For example, Shady Squirrel registered the domain advanceslibrary[.]com on June 27th likely specifically for SocGholish. Shortly after registration, injections calling the domain started rolling in, but we did not have a confirmed fake update payload until July 10th.
Both SocGholish and the unknown tech support scam actor are sent traffic via a custom injection, but most of the time Shady Squirrel relies on Keitaro injections—so let’s go there.
Keitaro Injections
The Keitaro injection seems banal at first. It constructs a URL for a Keitaro client with a handful of collected parameters and then calls it. In most of the cases we’ve seen, the returned script has done nothing. We called it “the boring injection.” Not only did the Shady Squirrel injection seem ordinary, but the Keitaro response itself never seemed to trigger any interesting payload. But in reviewing many publicly available scans, we realized the entire mechanism was more complicated and mysterious than we thought.
We still don’t fully understand this mechanism, but we know enough to realize it is interesting. Here’s what happens in that obfuscated script:
- It creates a window configuration with a random-looking name, e.g., _1yp7C3MQfbZ7qNXv, that is hard-coded into the actor’s script
- Within that config it sets three variables: unique, ttl, and R_PATH
- It collects or creates a series of parameters, and then constructs the final URL using R_PATH, the base of the Keitaro client
- It fetches the URL with an HTTP GET, passing the name=<window.config> value
Not super exciting, right? Well, the next script makes it more intriguing. The Keitaro server responds with a script that incorporates the name parameter, e.g., _1yp7C3MQfbZ7qNXv, to inherit the window configuration when the script is run client side. The script:
- Reads the local storage state
- Receives the campaign config, subid, and token value for related cookies
- Either does nothing, uses a meta-refresh to redirect, or injects HTML directly
The seemingly random window configuration variable is hard coded into the initial script and may be reused across injections. Figure 9 shows an example of this where Shady Squirrel is sandwiched between two calls to the same Keitaro server. In some cases, the Keitaro server itself is on a Shady Squirrel domain, and in other cases, like that in Figure 9, it is on different hosting that we can’t confirm is related.
Figure 9. An overview of the two-part Keitaro sequence based on a URLscan of an example indicator. The Shady Squirrel injection creates a window configuration that is consumed by the Keitaro that it subsequently calls.
So, who owns the Keitaro server? Not sure. It could be a central service or a kit, even both. We suspect it is a service, and Shady Squirrel is a client. But proving that, or who really controls it, seems difficult. All the confirmed Shady Squirrel Keitaro injects set one of two server cookies, 0c9c8 or 208c9. But these same cookies are seen for seemingly unrelated actors, including TA2726. In March, we postulated that these were genuine, randomly occurring collisions in the cookie names. But now we are not so sure. For example, we have seen cdnjslibraries[.]com, a Shady Squirrel dropcatch domain, used both as the Keitaro domain and later for the custom injection, which does not make an external Keitaro call.
Regardless of whether it is a kit, a service, or both, for sure it is a “style.” We can date the two-part Keitaro injection style to September 2020. In early versions of the handoff, the calling script was not obfuscated. Regardless, the response is always the same structure, utilizing the window configuration. Lo and behold, the earliest sample served a redirection! It went to the notorious Help TDS which then dumped out to an affiliate advertising platform smartlink. In this chain:
- The website contained widgets which loaded JavaScript from sport2news[.]com, which
- Constructed the window configuration and established both the Keitaro call and a postback link,
- Called the Keitaro server at ads-analytic[.]com, which returned JavaScript that
- Redirected to Help TDS for affiliate 7321600252413, which rejected the visitor and
- Called the TDS with affiliate id u=b1tk60t
We believe this surfaces a new attack chain for Help TDS. Instead of insertion into a compromised site through malicious plugins, it is returned via the Keitaro server. The same server, around the same time, redirects to the same affiliate advertising platform for a seemingly unrelated affiliate (u=pgbk60a). This is one reason we lean toward a service of some kind—though there could be kits and services combined! This same domain, ads-analytic[.]com was used for what appears to be an entirely different Keitaro server a few years later.
The two-part Keitaro injection, whether it be Shady Squirrel or Help TDS affiliates leveraging it, is a complex weave of domains that change hosting, nameservers, and ownership over time. One thing that is consistent over time is the use of Keitaro to send users to affiliate advertising platforms.
Adtech Redirection
Until late-November 2024, the Keitaro servers redirected users to a single advertising TDS. The redirections paused and resumed a year later. We found examples recently where a Shady Squirrel injection led to a different affiliate advertising network. In April 2025, for example, there is a scan on urlscan[.]io that starts with a Keitaro server and redirects to Shady Squirrel. We showed the relationship between the Keitaro server and Shady Squirrel earlier in Figure 9. In this instance, Shady Squirrel kicked off three events and one is a redirection to Propeller Ads’ push monetization service, ProPush. Figure 10 depicts the calls and redirection chain. In mid-July, the domains pausewatchings[.]com and pills-europe[.]com also sent traffic to ProPush.
Figure 10. A Shady Squirrel chain observed in July 2026 triggers both the two-part Keitaro injection as well as a pop-up notification request for Propeller’s ProPush service. It also incorporated a Binom tracker check.
ProPush is a special project of Propeller Ads, as described in Figure 11 from their own website. We’ve seen ProPush used more recently by Shady Squirrel as well. Whereas most of the time, scans with their injections will not trigger any payload, there are occasions where we’ve seen the redirection to adtech.
Figure 11. Screenshot of Propeller Ads describing ProPush (propush[.]me) in a Quick Start Guide available on their website
The domain pausewatchings[.]com was also leaked into a Facebook post on July 10th which seems a bit of an operational error by the actor. After remaining so stealthy for so long, a leak like this, as well as the adtech and SocGholish affiliations seem like a mighty big risk for Shady Squirrel.
Swiping Squirrel
Our final actor is another one involved in affiliate advertising. These dropcatch actors often co-exist on a single compromised website, just like the upstream threat actors they acquired the domains from. The one we see most often with Shady Squirrel is Swiping Squirrel. Indeed, we have seen them pick up domains from each other repeatedly, making it extra tricky to separate the activity without looking carefully at the scripts they deliver.
Where Shady Squirrel is a hard core blackhat operator, Swiping Squirrel lives in a greyhat world. They acquire domains, mostly from compromised sites, and they sell the traffic through brokers similar to Stuffy Squirrel. The website visitor is still likely to encounter malicious content, but it doesn’t come directly from Swiping Squirrel. As such they are at arm’s length from real harm.
According to our observations, Swiping Squirrel sells most of their traffic to Team Internet’s ZeroPark. They also appear to be enrolled in an affiliate program for AliExpress and a handful of other commerce entities.
Unlike Stuffy Squirrel, there are decent odds that a website visitor will land at malware through Swiping Squirrel due to the wide array of downstream advertisers from ZeroPark. We experienced a ClickFix attack this way: our click was sold by ZeroPark to AdventureFeeds, who in turn displayed the fake captcha, presumably through one of their own advertisers. AdventureFeeds has been reported multiple times as the source of malicious ads, including connections with a notorious malvertiser called master134 and in our own reporting on the dangers of zero click parking. We have reported both Swiping Squirrel and AdventureFeeds activity to Team Internet.
Figure 12 depicts how the upstream domain holders still drive traffic to affiliate programs through Swiping Squirrel.
Figure 12. Sample relationships between upstream actors and where the traffic is sold by Swiping Squirrel
We have identified over 3k domains acquired by Swiping Squirrel since 2022. Even though this actor is selling traffic and not directly connected to malicious content distribution, they engage in deceptive tactics, beyond the use of compromised websites for their traffic source. The actor uses client-side JavaScript to fingerprint the user. This script is delivered via the lingering URL on the website. But the Swiping Squirrel server will only return this script when it is called from within the site; attempting to fetch it directly results in a “not found” error. They then use the fingerprint results to cloak the domain. We consider all of this activity high risk to users and enterprises alike.
The Swiping Squirrel affiliate advertising chain is mapped out in Figure 13. The steps from a user visit to an unwanted “advertisement” are essentially a series of gates controlled by the actor:
- Using the URL that lingers on the website from the previous owner, Swiping Squirrel delivers a client-side fingerprint script. It does a basic anti-bot check and gathers information about the user, along with “campaign” information.
- The fingerprint and campaign information is sent to the cloaker, which typically resides on the same domain, using index.php.
- The cloaking server will either return an empty set ({}) or an “fw” response that triggers the next step: a second connection using the path /s/index/.
- The /s/index may return a meta-refresh response to a new domain, the relay server, using the path /f/index. It is this call that leads to a final bid for user traffic.
- The relay server sends an unconditional meta-refresh to the affiliate platform, e.g., ZeroPark, AliExpress, or Kelkoo.
Figure 13. The Swiping Squirrel affiliate advertising chain. The exact URL paths and parameters may vary.
It’s a roll of the dice from there—the user might get malware, a scam, or an Alibaba shopping page as “they” are sold to the highest bidder. Regardless of the path, content is delivered that the site visitor wasn’t expecting, and their “click” was gained fraudulently.
Parting Thoughts
We see around 65,000 new dropcatch domains every day. Some of them are legitimate registrations picking up domains people are going to use for commercial or personal use. But an awful lot are grabbed for grey to black purposes. Late last year, we covered the danger of zeroclick “advertising” through parked domains. What we haven’t talked about in this blog series on dropcatch is that a lot of the domains get parked in the same manner. In our companion report, we showed how one actor was using previously legitimate domains to prop up their malware and illegal gambling business. In this one, we saw how threat actors are repurposing expired malicious domains from website compromises. Any way you slice it, the risk posed by dropcatch domains is significant, arguably greater than that of newly registered domains.
Indicators
Indicators can also be found in our GitHub repository.
Stuffy Squirrel
| Stuffy Squirrel Dropcatch Domains |
|---|
| blocksovetnik[.]ru |
| checkoutbump[.]com |
| hpmdnetwork[.]ru |
| gsstats[.]ru |
| magesource[.]su |
| memtkh[.]com |
| renteres[.]ru |
| tofuturepubs[.]com |
| weatherplllatform[.]com |
Shady Squirrel
| Shady Squirrel Dropcatch Domains |
|---|
| advanceslibrary[.]com |
| blacksaltys[.]com |
| brodirect3s[.]site |
| cdnjslibraries[.]com |
| imhd[.]io |
| pausewatchings[.]com |
| pills-europe[.]com |
| simplejscdn[.]com |
| wesq[.]me |
Swiping Squirrel
| Swiping Squirrel Dropcatch Domains |
|---|
| blackshelter[.]org |
| bluegaslamp[.]org |
| draggedline[.]org |
| getshopstar[.]com |
| jqueryapihelpers[.]com |
| lzdatheme[.]com |
| slurpslimes[.]org |
| webpixel[.]app |
| windowlight[.]org |
