Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

Infoblox analyzes a class of criminal “dropcatch” actors who buy expired malicious domains left in thousands of compromised sites and monetize that traffic by redirecting victims to affiliate ad networks, tech-support scams, and malware distributors (including SocGholish). The report profiles three operators—Stuffy Squirrel (script-based popunder TDS and affiliate fraud), Shady Squirrel (highly cloaked TDS sending traffic to tech-support scams, SocGholish, and Keitaro chains), and Swiping Squirrel (traffic reseller feeding ZeroPark/Zero-click ad platforms)—describing their evasion, monetization, and thousands of acquired domains with concrete IOCs.