Home / Technology / Expired Domains Now Criminal Goldmines
Expired Domains Now Criminal Goldmines
21 Aug
Summary
- Criminals buy expired domains daily for traffic and authority.
- One actor spent over $7 million on expired domain names.
- Some expired domains are used for malware command and control.
A significant security threat has emerged where cybercriminals are exploiting the established trust and authority of expired domain names. In the first half of 2026, an estimated 65,000 expired domains were re-registered daily, representing nearly one in five new registrations. This practice is particularly pronounced on .net and .xyz domains.
Security researchers have identified an actor, named Sable Squirrel, that controls over 10,000 domains. This entity has reportedly spent more than $7 million acquiring expired domains to leverage their inherited traffic and authority, primarily for a large Vietnamese-language sports piracy and gambling operation. The domains were used for brands like Xoilac and Cakhia.
Compounding the threat, Infoblox Threat Intel discovered that a subset of these domains also serves as command-and-control (C2) infrastructure for various malware, including Quasar RAT and HiddenTear ransomware. This weaponization occurred in late 2025. Despite law enforcement actions in February and March 2026 that led to site freezes and asset seizures, the operation continues to expand.
