Dropcatch Scavengers: Expired Malicious Domains Become Cash Cows

This report analyzes a class of financially motivated 'dropcatch' actors that purchase expired malicious domains left in compromised websites and repurpose the inherited traffic to serve scams, malware, and affiliate/ad-fraud. It profiles three operators — Stuffy Squirrel (hides payloads in legitimate scripts and uses popunders), Shady Squirrel (highly cloaked TDS that has routed traffic to tech support scams and SocGholish via Keitaro injections), and Swiping Squirrel (sells traffic to ad brokers like ZeroPark) — describes their multi-layered evasion and distribution chains, quantifies their scale (hundreds to thousands of domains), and provides domain IOCs used by each actor.