Executive Summary<\/h3>\n
Purchasing expired domains from legitimate companies is a well-known threat actor trick. By acquiring these domains, a practice called dropcatch, they gain the reputation of the original owner. In our companion blog, we introduced a threat actor who has spent massive amounts of money doing exactly this to prop up their malware and gambling operations. But there\u2019s another class of dropcatch actors who repurpose malicious domains. It\u2019s surprising at first, but it actually makes sense. Here\u2019s why.<\/p>\n
Every year, tens of thousands of websites are compromised, leading hapless visitors to a wide variety of scams and malware. Some of the most pernicious threat actors, like SocGholish and ClearFake, use these sites to steal user credentials and sell them to others for further exploitation. These compromised sites typically contact an actor-controlled domain for a routing decision of the potential victim. When those domains expire and go unclaimed, the requests do not stop; they simply go unanswered.<\/p>\n
Why let a good compromise go to waste? For the threat actors we describe in this blog, that gap\u2014the dropped domain\u2014is a business opportunity. Instead of compromising websites themselves, these actors acquire expired domains and immediately begin receiving traffic from the infection chains their predecessors left behind. Then they inject their own content. They are in effect, scavengers.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/drop-catch-part-3-thumbnail.jpeg\")
<\/p>\n
What you will learn here is that the nature of the scavenger varies. They all fraudulently acquire traffic and resell it to affiliate programs, but the way in which they do so, and the impact to users varies widely. There\u2019s nothing in plain sight. These financially motivated actors have gone unnoticed because they obfuscate their operations, both in their scripts and in server-side cloaking. One actor sells to a large global media commerce platform, another sells to advertising networks most people won\u2019t recognize, and the third sells traffic to big name cybercriminals like SocGholish.<\/p>\n
They co-exist on many compromised websites, operating in a race condition to grab the potential victim. Often domains pass from one of these actors to another over time. Between the three actors highlighted here, they own thousands of domains embedded in tens of thousands of compromised sites. Despite their widespread presence, to our knowledge, none of these have been discussed before.<\/p>\n
This blog covers three of the dropcatch actors we have been tracking via DNS, along with their ecosystem (Figure 1):<\/p>\n
- \n
- Stuffy Squirrel is a specialist in stuffing their malicious activity into legitimate scripts<\/li>\n
- Shady Squirrel partners with initial access brokers and enabled a large-scale return by SocGholish less than a month after disruption by Operation Endgame<\/strong><\/a>. Research led to several discoveries, including a tech support actor, a previously unpublished two-part Keitaro injection chain, and an unusual Help TDS infection vector<\/li>\n
- Swiping Squirrel, the most prolific of the bunch, sends their fraudulent traffic to zero click advertising platforms which is resold and often ends at scams or malware<\/li>\n<\/ul>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure1.jpg\")
<\/p>\nFigure 1. The dropcatch actors and ecosystem covered in this paper<\/p>\n
The Scavenging Model<\/h3>\n
There is a surprising amount of dropcatch acquisition of \u201cknown bad\u201d domains. Security companies\u2014like us\u2014sometimes acquire malicious domains to collect telemetry about compromised hosts. But we have uncovered several actors who grab expired malicious domains so they can repurpose them. As far as we can tell, these actors monitor compromised websites, just like the security industry does, and when the domain expires, they swoop in to claim it. Once they own the domain, without hacking anything, they redirect users to their own scams or malware. A domain that is embedded in thousands of old sites can make the rounds through several threat actors all through dropcatch or variations of it.<\/p>\n
We originally referred to this class of actors as \u201cThieves\u2019 Thieves\u201d because they grab traffic from other criminals, but really, they are opportunistic scavengers. Aside from purchasing expired malicious domains, we have found that they often coexist on a compromised site. The result is a race to acquire victims: the same compromised domain may be redirected by different dropcatch actors depending on website visitor characteristics, timing, and other factors. We use squirrels for threat actors that are domain hoarders. The three actors we will describe here are full of mischief and thievery you expect from the clever animals you contend with in your own backyard. They are indeed scavengers.<\/p>\n
Stuffy Squirrel<\/h3>\n
True to their name, Stuffy Squirrel is a specialist in hiding malicious activity inside legitimate scripts. The actor has been continuously active since at least 2020 and has operated a traffic distribution system (TDS) across three generations of dedicated infrastructure. They sell traffic to specific affiliate advertising networks. The website visitor may end at a scam, unwanted content, or a decoy<\/strong><\/a>.<\/p>\n
They have maintained the same publisher account identifier across all of them\u2014evidence of a single, persistent operator. The infrastructure consists almost entirely of dropped domains that once served malicious infrastructure for various actors, including TA2726, and actors running Magecart and Balada injection campaigns. We have identified over 500 domains controlled by this actor.<\/p>\n
Evading Detection<\/strong><\/p>\n
Stuffy Squirrel evades detection through two independent server-side checkpoints, either of which can stop the chain before any malicious activity is visible. These techniques have kept them in business for the last six years. See Figure 2 for a depiction of how this actor operates; details of these steps follow.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure2.jpg\")
<\/p>\nFigure 2. The event chain for Stuffy Squirrel<\/p>\n
The first check comes when a victim loads the compromised page. The live payload is served only when the incoming request matches the specific URL the original attacker left behind in the victim site’s code. Any other request\u2014a scanner probing the actor\u2019s dropcatch domain directly, a path that was never previously embedded in a victim page\u2014receives a decoy instead. The decoy is a legitimate and widely used Scalable Vector Graphics (SVG) mathematics library, Rapha\u00ebl.js<\/strong><\/a>.<\/p>\n
The live payload is the same filename but with a 1,225 character Immediately Invoked Function Expression (IIFE) inserted that executes when the script loads and removes itself from the page when finished. To a scanner, both files look like Raphael.js. The difference is invisible until the IIFE runs.<\/p>\n
The second check occurs when the payload attempts to call the actor\u2019s popunder advertising gateway. Even when the browser passes the first check and the IIFE executes, the TDS evaluates each incoming request independently and doesn\u2019t always respond. We have seen instances where the payload executed and no popunders were served. This is due to a third layer of evasion that sits beyond both server-side checks: the popunder windows only open on a real user click. Even when both checks pass and the ad delivery platform loads successfully, nothing happens until the visitor interacts with the page. Automated scanners execute scripts but do not click, so the final delivery stage\u2014the popunder windows and everything downstream of them\u2014remains completely invisible to automated analysis even when the full chain is active.<\/p>\n
All three checks operate independently.<\/p>\n
Inside the Injection<\/strong><\/p>\n
Stuffy Squirrel\u2019s presence on a compromised site is split into two components. The first is a script server: a dedicated domain hosting the actor\u2019s malicious JavaScript that loads when a user visits the site. The history of these domains illustrates the layers of the scavenging model. The domain weatherplllatform[.]com was previously used<\/strong><\/a> as Balada injector infrastructure, infecting thousands of WordPress sites during the campaign’s peak and was Sucuri\u2019s<\/strong><\/a> second most-blocklisted resource in 2022. The domain magesource[.]su was previously used as a Magecart card-skimming<\/strong><\/a> domain targeting compromised Magento stores to steal payment card data. In both cases, Stuffy Squirrel inherited not just the domain but the entire well-established victim pool that came with it.<\/p>\n
The first script acts as a remote JavaScript loader dynamically building a script element and loading from another actor-controlled domain. This second domain coordinates the popunder delivery chain, routing victim traffic to an advertising exchange where it is auctioned in real time. Since November 2025, gsstats[.]ru has served as the actor\u2019s current primary entry point, replacing tofuturepubs[.]com, which was used throughout 2024 and 2025. The second part of the process is done over several calls to the same entry point. The victim\u2019s URL is encoded and passed it to the server, which then triggers the popunder delivery chain after user interaction, handing the visit to an ad exchange. The primary script also features an error-reporting mechanism: if the domain is unreachable within five seconds, the script uses a tracking pixel and sends an HTTP request back to the script server domain, notifying the operator. If downstream ad delivery fails, the server receives an immediate callback reporting the failure, allowing the actor to monitor its own delivery pipeline in real time.<\/p>\n
Monetization Methods<\/strong><\/p>\n
Stuffy Squirrel has consistently monetized their operations through affiliate advertising platforms. These platforms operate in several verticals but are dominated by adult content. Other verticals we\u2019ve seen include e-commerce affiliate fraud and online gambling. We\u2019ve organized the actor\u2019s affiliate network activity into two phases based on observed shifts in platform preference.<\/p>\n
Phase I: PushHouse and ExoClick<\/p>\n
- \n
- Through January 2025, the actor operated as a publisher in the PushHouse network, a company known for popunder and in-page push notification ad delivery. The actor also simultaneously ran ExoClick popunder ads, routed through actor-controlled TDS domains to ExoClick\u2019s delivery infrastructure.<\/li>\n<\/ul>\n
Phase II: ExoClick and an unknown Russian popunder network<\/p>\n
- \n
- Since March 2025, the actor has continued to publish for ExoClick while migrating from PushHouse to a Russian popunder advertising network. It is likely that this is a commercial affiliate advertising network. This network has cycled through multiple backend domains, all white-label deployments of the same underlying ad platform sharing the actor’s persistent publisher ID. When triggered, the platform opens popunder windows which route visitor traffic through an advertising exchange and ultimately delivers it to the destination. ExoClick delivers its own popunders through a parallel channel simultaneously, confirming both systems remain active at the same time on the same compromised page.<\/li>\n<\/ul>\n
Shady Squirrel<\/h3>\n
While the financial fraud of Stuffy Squirrel might not seem that serious, Shady Squirrel is a totally different matter. You aren\u2019t going to find this character showing their true colors via open-source scanning sites. Their malicious behavior is only triggered when the URL visited contains a specific referral record. Even then, victims must pass through a multi-step cloaking filter before any malicious content is served. The Russian-speaking actor operates a TDS grounded in domains that linger within compromised websites. They use custom JavaScript injections, as well as Keitaro, and server-side fingerprinting. If a bot or scanner is detected, the original page<\/strong><\/a> will be shown.<\/p>\n
For a long time, we tracked their activity but weren\u2019t sure of the purpose. That all changed in June when Randy McEoin saw that an old TA2726 domain was serving up tech support scams\u2014the nut cracked open. A few weeks later, Randy uncovered a real surprise: Shady Squirrel was sending traffic to the notorious threat actor SocGholish. Suddenly, Shady Squirrel went from \u201creally interesting\u201d to \u201ccrazy interesting.\u201d And this is why we believe collaboration is key to success in cybersecurity.<\/p>\n
Shady Squirrel has operated since at least July 2023. In 2026, they sent traffic to four downstream actors: a Russian gambling platform called 1Win; a tech support scam actor; the original fake update actor, SocGholish; and a Keitaro server. The Keitaro injections operate in an unusual manner; more about that later.<\/p>\n
To make it through the TDS gates to a final payload (aka \u201cmoney page\u201d or \u201cblack page\u201d), the URL must include a specific referrer string. In the 1Win case<\/strong><\/a>, an internal referral is used to load a sticky on-page gambling banner. The redirects in the tech support scams and SocGholish require the referrer to be a search engine. Even then, most visits will end up at the original website. Figure 3 shows an overview of payload routing.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure3.jpg\")
<\/p>\nFigure 3. Payload routing for Shady Squirrel; when the compromised page is scanned or visited directly, no action will occur<\/p>\n
We have identified over 700 domains acquired by Shady Squirrel since 2023. While they do freshly register some domains, their portfolio is primarily composed of dropcatch domains previously operated by other threat actors and left dormant on compromised sites before being reactivated for Shady Squirrel infrastructure. These include domains previously operated by malware actors like TA2726 as well as affiliate advertising platforms. In one high profile case, they snagged a legitimate domain that was used in cookie consent; a clever supply chain hijack. The domains they have purchased or otherwise acquired include:<\/p>\n
- \n
- blacksaltys[.]com<\/strong><\/a> (formerly TA2726)<\/li>\n
- simplejscdn[.]com<\/strong><\/a> (formerly used by affiliate of commercial push notification service)<\/li>\n
- brodirect3s[.]site<\/strong><\/a> (formerly commercial push notification service)<\/li>\n
- wesq[.]me<\/strong><\/a> (formerly commercial push notification service affiliate)<\/li>\n
- imhd[.]io (formerly a legitimate CDN)<\/li>\n<\/ul>\n
Figure 4 depicts the actor\u2019s domain acquisition trends. The values are estimates based on the domains we have been able to confirm. Shady Squirrel\u2019s activity appears to be run-of-the-mill arbitrage until early 2025 when they begin injecting calls to a Keitaro server. Later in 2026, they use the same style to make custom injections.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure4.jpg\")
<\/p>\nFigure 4. Estimated cumulative growth of Shady Squirrel\u2019s domain stash. Each month indicates the number of actively controlled domains at that time.<\/p>\n
While Shady Squirrel primarily gains access to sites through existing compromises, we have seen direct injection of their scripts into several sites. In one July 2026 example<\/strong><\/a>, we saw two different styles of injections, both belonging to the threat actor, appended to legitimate themes files used by the website. This would indicate that they are either in the WordPress exploitation game themselves or have affiliates using their scripts. In these cases, they are using newly registered domains instead of dropcatch ones.<\/p>\n
There are a few versions of their bespoke injection scripts. We believe the injections are primarily used to drive traffic to tech support scams, though in the past they also sent traffic to affiliate marketing networks. In some cases, a newly created domain is used for a Keitaro injection for some months and then begins serving the custom injection. The reason for this isn\u2019t clear. We\u2019ll start with their affiliation with initial access brokers and then come back to the Keitaro servers.<\/p>\n
The Tech Support Scam Actor<\/strong><\/p>\n
Because Shady Squirrel is resistant to scanning, we confirmed the browser lock operation on a research machine and analyzed the resulting packet capture. Redirection only occurred when the site visit came from a search engine, and when the device was running the Windows operating system. A series of pop-up windows filled the screen with warnings that the machine had been hacked, and that the user needed to dial Microsoft support at a specific phone number; see Figure 5.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure5.jpg\")
<\/p>\nFigure 5. Screenshot of the false tech support alarm targets Japanese and U.S. residents<\/p>\n
While it is difficult to find evidence of Shady Squirrel redirections in open-source tools, there are many scans for the tech support scam actor<\/strong><\/a>. The word scam here is misleading. These actors use live call centers to convince people to install remote access tools, giving them full control of the machine. It\u2019s a lot worse than buying an unnecessary antivirus subscription. From that point, the actor can steal credentials and sell them to others for a variety of uses, including enterprise data breaches. The campaigns we are tracking were first seen in April 2026. They only target victims in Japan and the United States.<\/p>\n
Figure 6 shows an overview of the complete attack from the compromised site injections to the tech support alerts. When the malicious site is reached, it quickly redirects to load a static HTML page with a random filename. A 1×1 pixel image is fetched to capture the visitor\u2019s IP address and user agent information. The IP address is used to determine which phone number to display, and likely to credit the publishing affiliate for the visit as well.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure6.jpg\")
<\/p>\nFigure 6. The attack chain from Shady Squirrel to a Windows machine compromise through the affiliated tech support actor<\/p>\n
Figure 6 excludes a connection to a second domain, which returns the call center phone number. We probed this second set of domains from various locations and user agents to identify active call centers. Our experiment revealed three numbers, all routed to the United States:<\/p>\n
- \n
- (201) 409-2894 (seen for Japanese targets only)<\/li>\n
- (877) 481-2126 (toll free)<\/li>\n
- (888) 756-6605 (toll free)<\/li>\n<\/ul>\n
A specific URL format identifies the affiliate. When we probed the domains directly, e.g., renpaste[.]top, it returned \u201cfuck you pig.\u201d In other public scans<\/strong><\/a>, renpaste[.]top claims to be a \u201csnippet hosting service,\u201d i.e., a service to host configs via links. Indeed, that is what it does. Since April, we have observed nine phone number server domains.<\/p>\n
The HTML content is a bit of a mystery. It contains an AES-encrypted section that is decrypted client-side using the URL fragment as the key. However, we never captured a URL containing that fragment, and the scam content loads regardless of decryption. The payload page is reached via a client-side navigation triggered by an initial request to the parent directory. And that directory-level response is exactly the kind of fast, small reply that scanners are known to miss. Perhaps there is a fragment passed in some cases that would decrypt the blob; we just aren\u2019t sure.<\/p>\n
As of early July, that unknown technical support scam actor has gone silent. Before that, the thief abused Microsoft Azure static webhosting to serve lures, creating nearly 10k accounts a month across at least nine regions globally. Each site was short-lived. We suspect this actor had multiple affiliates but can’t confirm. From our observations, Shady Squirrel seemed to be their largest source of traffic. It makes sense: Shady Squirrel takes advantage of thousands of long-compromised websites to identify potential victims, whereas the other affiliates appear to be creating new traffic sources.<\/p>\n
Right when Shady Squirrel stopped sending traffic to the tech support scam actor (and in fact we saw no more activity related to that actor anywhere), we saw them begin to send traffic to SocGholish.<\/p>\n
SocGholish<\/strong><\/p>\n
Our original plan was to trigger the tech support scam, call the number, and record the conversation. We could use the data captured during that experience to understand what technique they use to get into victims\u2019 machines. We started with a Google search result for a compromised domain (Figure 7). But this was before we uncovered the shift away from the tech support scam, so when we went to make the call, we were redirected to a fake update instead! See Figure 8. Not surprisingly, the update was identified as malware<\/strong><\/a>. The next day, Randy McEoin validated the path as SocGholish.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure7.jpg\")
<\/p>\nFigure 7. Screenshot of the lure used to trigger the Shady Squirrel redirection to SocGholish found via Google search run in mid-July 2026<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure8.jpg\")
<\/p>\nFigure 8. Screenshot of a SocGholish fake update delivered via Shady Squirrel on July 10, 2026<\/p>\n
At that point, the Shady Squirrel story became even more interesting. SocGholish had been disrupted by Operation Endgame<\/strong><\/a>, a joint law enforcement and industry action, less than a month earlier, in mid-June 2026. Over 300 servers and 140 domains were seized or cleaned during the event, and cryptocurrency assets totaling more than $41million Euro were frozen. Actions like these are impactful but unfortunately also temporary. The question is always how quickly the actor will recover and what will they do next? In this case, we now know they partnered with Shady Squirrel, regaining access to tens of thousands of compromised sites effortlessly about 10 days later.<\/p>\n
For example, Shady Squirrel registered the domain advanceslibrary[.]com on June 27th likely specifically for SocGholish. Shortly after registration, injections calling the domain started rolling in, but we did not have a confirmed fake update payload until July 10th.<\/p>\n
Both SocGholish and the unknown tech support scam actor are sent traffic via a custom injection, but most of the time Shady Squirrel relies on Keitaro injections\u2014so let\u2019s go there.<\/p>\n
Keitaro Injections<\/strong><\/p>\n
The Keitaro injection seems banal at first. It constructs a URL for a Keitaro client with a handful of collected parameters and then calls it. In most of the cases we\u2019ve seen, the returned script has done nothing. We called it \u201cthe boring injection.\u201d Not only did the Shady Squirrel injection seem ordinary, but the Keitaro response itself never seemed to trigger any interesting payload. But in reviewing many publicly available scans, we realized the entire mechanism was more complicated and mysterious than we thought.<\/p>\n
We still don\u2019t fully understand this mechanism, but we know enough to realize it is interesting. Here\u2019s what happens in that obfuscated script:<\/p>\n
- \n
- It creates a window configuration with a random-looking name, e.g., _1yp7C3MQfbZ7qNXv, that is hard-coded into the actor\u2019s script<\/li>\n
- Within that config it sets three variables: unique, ttl, and R_PATH<\/li>\n
- It collects or creates a series of parameters, and then constructs the final URL using R_PATH, the base of the Keitaro client<\/li>\n
- It fetches the URL with an HTTP GET, passing the name=<window.config> value<\/li>\n<\/ul>\n
Not super exciting, right? Well, the next script makes it more intriguing. The Keitaro server responds with a script that incorporates the name parameter, e.g., _1yp7C3MQfbZ7qNXv, to inherit the window configuration when the script is run client side. The script:<\/p>\n
- \n
- Reads the local storage state<\/li>\n
- Receives the campaign config, subid, and token value for related cookies<\/li>\n
- Either does nothing, uses a meta-refresh to redirect, or injects HTML directly<\/li>\n<\/ul>\n
The seemingly random window configuration variable is hard coded into the initial script and may be reused across injections. Figure 9 shows an example of this where Shady Squirrel is sandwiched between two calls to the same Keitaro server. In some cases, the Keitaro server itself is on a Shady Squirrel domain, and in other cases, like that in Figure 9, it is on different hosting that we can\u2019t confirm is related.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure9.jpg\")
<\/p>\nFigure 9. An overview of the two-part Keitaro sequence based on a URLscan<\/strong><\/a> of an example indicator. The Shady Squirrel injection creates a window configuration that is consumed by the Keitaro that it subsequently calls.<\/p>\n
So, who owns the Keitaro server? Not sure. It could be a central service or a kit, even both. We suspect it is a service, and Shady Squirrel is a client. But proving that, or who really controls it, seems difficult. All the confirmed Shady Squirrel Keitaro injects set one of two server cookies, 0c9c8 or 208c9. But these same cookies are seen for seemingly unrelated actors, including TA2726. In March<\/strong><\/a>, we postulated that these were genuine, randomly occurring collisions in the cookie names. But now we are not so sure. For example, we have seen cdnjslibraries[.]com, a Shady Squirrel dropcatch domain, used both as the Keitaro domain and later for the custom injection, which does not make an external Keitaro call.<\/p>\n
Regardless of whether it is a kit, a service, or both, for sure it is a \u201cstyle.\u201d We can date the two-part Keitaro injection style to September 2020<\/strong><\/a>. In early versions of the handoff, the calling script was not obfuscated. Regardless, the response is always the same structure, utilizing the window configuration. Lo and behold, the earliest sample served a redirection! It went to the notorious Help TDS<\/strong><\/a> which then dumped out to an affiliate advertising platform smartlink. In this chain:<\/p>\n
- \n
- The website contained widgets which loaded JavaScript from sport2news[.]com, which<\/li>\n
- Constructed the window configuration and established both the Keitaro call and a postback link,<\/li>\n
- Called the Keitaro server at ads-analytic[.]com, which returned JavaScript that<\/li>\n
- Redirected to Help TDS for affiliate 7321600252413, which rejected the visitor and<\/li>\n
- Called the TDS with affiliate id u=b1tk60t<\/li>\n<\/ul>\n
We believe this surfaces a new attack chain for Help TDS. Instead of insertion into a compromised site through malicious plugins, it is returned via the Keitaro server. The same server, around the same time, redirects to the same affiliate advertising platform for a seemingly unrelated affiliate<\/strong><\/a> (u=pgbk60a). This is one reason we lean toward a service of some kind\u2014though there could be kits and services combined! This same domain, ads-analytic[.]com was used for what appears to be an entirely different Keitaro server a few years later.<\/p>\n
The two-part Keitaro injection, whether it be Shady Squirrel or Help TDS affiliates leveraging it, is a complex weave of domains that change hosting, nameservers, and ownership over time. One thing that is consistent over time is the use of Keitaro to send users to affiliate advertising platforms.<\/p>\n
Adtech Redirection<\/strong><\/p>\n
Until late-November 2024, the Keitaro servers redirected users to a single advertising TDS. The redirections paused and resumed a year later. We found examples recently where a Shady Squirrel injection led to a different affiliate advertising network. In April 2025, for example, there is a scan on urlscan[.]io<\/strong><\/a> that starts with a Keitaro server and redirects to Shady Squirrel. We showed the relationship between the Keitaro server and Shady Squirrel earlier in Figure 9. In this instance, Shady Squirrel kicked off three events and one is a redirection to Propeller Ads\u2019 push monetization service, ProPush. Figure 10 depicts the calls and redirection chain. In mid-July, the domains pausewatchings[.]com and pills-europe[.]com also sent traffic to ProPush.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure10.jpg\")
<\/p>\nFigure 10. A Shady Squirrel chain observed in July 2026 triggers both the two-part Keitaro injection as well as a pop-up notification request for Propeller\u2019s ProPush service. It also incorporated a Binom tracker check.<\/p>\n
ProPush is a special project of Propeller Ads, as described in Figure 11 from their own website. We\u2019ve seen ProPush used more recently by Shady Squirrel as well. Whereas most of the time, scans with their injections will not trigger any payload, there are occasions where we\u2019ve seen the redirection to adtech.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure11.jpg\")
<\/p>\nFigure 11. Screenshot of Propeller Ads describing ProPush (propush[.]me) in a Quick Start Guide available on their website<\/strong><\/a><\/p>\n
The domain pausewatchings[.]com was also leaked into a Facebook post on July 10th which seems a bit of an operational error by the actor. After remaining so stealthy for so long, a leak like this, as well as the adtech and SocGholish affiliations seem like a mighty big risk for Shady Squirrel.<\/p>\n
Swiping Squirrel<\/h3>\n
Our final actor is another one involved in affiliate advertising. These dropcatch actors often co-exist on a single compromised website, just like the upstream threat actors they acquired the domains from. The one we see most often with Shady Squirrel is Swiping Squirrel. Indeed, we have seen them pick up domains from each other repeatedly, making it extra tricky to separate the activity without looking carefully at the scripts they deliver.<\/p>\n
Where Shady Squirrel is a hard core blackhat operator, Swiping Squirrel lives in a greyhat world. They acquire domains, mostly from compromised sites, and they sell the traffic through brokers similar to Stuffy Squirrel. The website visitor is still likely to encounter malicious content, but it doesn\u2019t come directly from Swiping Squirrel. As such they are at arm\u2019s length from real harm.<\/p>\n
According to our observations, Swiping Squirrel sells most of their traffic to Team Internet\u2019s ZeroPark. They also appear to be enrolled in an affiliate program for AliExpress and a handful of other commerce entities.<\/p>\n
Unlike Stuffy Squirrel, there are decent odds that a website visitor will land at malware through Swiping Squirrel due to the wide array of downstream advertisers from ZeroPark. We experienced a ClickFix attack this way: our click was sold by ZeroPark to AdventureFeeds, who in turn displayed the fake captcha, presumably through one of their own advertisers. AdventureFeeds has been reported multiple times as the source of malicious ads, including connections with a notorious malvertiser<\/strong><\/a> called master134 and in our own reporting<\/strong><\/a> on the dangers of zero click parking. We have reported both Swiping Squirrel and AdventureFeeds activity to Team Internet.<\/p>\n
Figure 12 depicts how the upstream domain holders still drive traffic to affiliate programs through Swiping Squirrel.<\/p>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure12.jpg\")
<\/p>\nFigure 12. Sample relationships between upstream actors and where the traffic is sold by Swiping Squirrel<\/p>\n
We have identified over 3k domains acquired by Swiping Squirrel since 2022. Even though this actor is selling traffic and not directly connected to malicious content distribution, they engage in deceptive tactics, beyond the use of compromised websites for their traffic source. The actor uses client-side JavaScript to fingerprint the user. This script is delivered via the lingering URL on the website. But the Swiping Squirrel server will only return this script when it is called from within the site; attempting to fetch it directly results in a \u201cnot found\u201d error<\/strong><\/a>. They then use the fingerprint results to cloak the domain. We consider all of this activity high risk to users and enterprises alike.<\/p>\n
The Swiping Squirrel affiliate advertising chain is mapped out in Figure 13. The steps from a user visit to an unwanted \u201cadvertisement\u201d are essentially a series of gates controlled by the actor:<\/p>\n
- \n
- Using the URL that lingers on the website from the previous owner, Swiping Squirrel delivers a client-side fingerprint script. It does a basic anti-bot check and gathers information about the user, along with \u201ccampaign\u201d information.<\/li>\n
- The fingerprint and campaign information is sent to the cloaker, which typically resides on the same domain, using index.php.<\/li>\n
- The cloaking server will either return an empty set ({}) or an \u201cfw\u201d response that triggers the next step: a second connection using the path \/s\/index\/.<\/li>\n
- The \/s\/index may return a meta-refresh response to a new domain, the relay server, using the path \/f\/index. It is this call that leads to a final bid for user traffic.<\/li>\n
- The relay server sends an unconditional meta-refresh to the affiliate platform, e.g., ZeroPark, AliExpress, or Kelkoo.<\/li>\n<\/ul>\n
![](\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/dropcatch-scavengers-expired-malicious-domains-become-cash-cows-figure13.jpg\")
<\/p>\nFigure 13. The Swiping Squirrel affiliate advertising chain. The exact URL paths and parameters may vary.<\/p>\n
It\u2019s a roll of the dice from there\u2014the user might get malware, a scam, or an Alibaba shopping page as \u201cthey\u201d are sold to the highest bidder. Regardless of the path, content is delivered that the site visitor wasn\u2019t expecting, and their “click\u201d was gained fraudulently.<\/p>\n
Parting Thoughts<\/h3>\n
We see around 65,000 new dropcatch domains every day. Some of them are legitimate registrations picking up domains people are going to use for commercial or personal use. But an awful lot are grabbed for grey to black purposes. Late last year, we covered the danger of zeroclick \u201cadvertising\u201d<\/strong><\/a> through parked domains. What we haven\u2019t talked about in this blog series on dropcatch is that a lot of the domains get parked in the same manner. In our companion report, we showed how one actor was using previously legitimate domains to prop up their malware and illegal gambling business. In this one, we saw how threat actors are repurposing expired malicious domains from website compromises. Any way you slice it, the risk posed by dropcatch domains is significant, arguably greater than that of newly registered domains.<\/p>\n
Indicators<\/h3>\n
- simplejscdn[.]com<\/strong><\/a> (formerly used by affiliate of commercial push notification service)<\/li>\n
- blacksaltys[.]com<\/strong><\/a> (formerly TA2726)<\/li>\n
- Since March 2025, the actor has continued to publish for ExoClick while migrating from PushHouse to a Russian popunder advertising network. It is likely that this is a commercial affiliate advertising network. This network has cycled through multiple backend domains, all white-label deployments of the same underlying ad platform sharing the actor’s persistent publisher ID. When triggered, the platform opens popunder windows which route visitor traffic through an advertising exchange and ultimately delivers it to the destination. ExoClick delivers its own popunders through a parallel channel simultaneously, confirming both systems remain active at the same time on the same compromised page.<\/li>\n<\/ul>\n
- Swiping Squirrel, the most prolific of the bunch, sends their fraudulent traffic to zero click advertising platforms which is resold and often ends at scams or malware<\/li>\n<\/ul>\n