The Internet Still Trusts Dead Websites - Sable Squirrel’s 10,000-Domain Network
Sable Squirrel controls more than 10,000 domains, many acquired after earlier owners let them expire. A familiar address can keep its reputation even when the person behind it has completely changed.
Incident overview
Infoblox researchers reported that the group they call Sable Squirrel controls more than 10,000 domains. Many were acquired after expiring, and the researchers linked parts of the network to illegal streaming, gambling, and malware command-and-control activity.
Why it works
A web address can feel familiar because it is easy to recognize and may still carry years of links, traffic, and reputation. That mental ease is not proof that the current owner is the organization a visitor remembers.
Protective actions
- Notice what the site asks you to do, especially any new download, login, or permission request.
- If a familiar site behaves differently, pause and verify its current owner through another official channel.
- Treat a remembered address as a locator, not permanent proof of who controls the site today.
- Organizations should inventory important domains, renew them deliberately, and retire old links before allowing a domain to expire.
- Security teams should watch for abandoned domains that still receive traffic or remain connected to trusted services.
Video companion
Watch the breakdown
A familiar address can have a completely different owner
Web domains expire. When an earlier owner does not renew one, another person or organization can register it. The letters in the address may stay exactly the same while the person controlling what appears there changes.
That matters because an expired domain can retain more than a recognizable name. Old links, browser history, search results, email references, and a reputation built by the previous owner may continue directing people and systems to the address.
What Infoblox reported
Infoblox researchers use the name Sable Squirrel for an operation they say controls more than 10,000 domains. Many support illegal sports-streaming and betting sites, while a subset were also connected to malware command-and-control activity.
The researchers reported more than 31,000 malware samples communicating with domains in the network. They also described former domains of real businesses, charities, public initiatives, academic projects, and a cybersecurity company among the addresses acquired.
Infoblox confirmed more than $430,000 in advertised prices across a sample of roughly 160 domains. Its figure of more than $7 million for the wider operation is an extrapolated estimate, not a verified total payment record.
The psychology: processing fluency
Processing fluency is the sense of ease we experience when something is simple to recognize or understand. Familiarity can increase that ease. Under some conditions, people may use the feeling as a quick cue that something is true, safe, or trustworthy.
In a 1999 experiment, statements presented in an easier-to-read format were more likely to be judged true than statements that were slightly harder to read. The study did not examine websites, expired domains, or cybercrime. It supports the general point that ease of processing can influence a judgment; it does not prove why any particular visitor trusts a site.
An address you have seen before can therefore feel reassuring before you have checked who owns it now.
Fact, interpretation, and uncertainty
The size and observed uses of the Sable Squirrel network are findings reported by Infoblox and summarized by independent reporting. The $7 million total is Infoblox’s estimate based on a smaller confirmed sample.
The processing-fluency connection is Connor’s cyberpsychology interpretation. It is not an Infoblox finding and it does not mean every familiar site will be trusted or every expired domain is malicious.
The available sources do not establish how many people were deceived, how many visits were driven by residual trust, or whether every domain in the network served harmful content.
Notice behavior before appearance
A site’s behavior is often more useful than its familiar appearance. If a site you recognize suddenly asks for a download, a new login, unusual browser permissions, or a different kind of payment, treat the change as the warning.
Verify the organization through another channel it currently controls. For organizations, keep an inventory of important domains and retire old links before letting an address expire.
Don’t let familiarity be your verification.
Sources
- Illegal Streaming Fronts a $7M Dropcatch Domain Operation with a Malware Secret (opens in a new tab)
Infoblox Threat Intel · August 13, 2026
Supports: Primary research for the Sable Squirrel name, the network of more than 10,000 domains, the confirmed priced-domain sample, the estimated total spend, the illegal-streaming and betting infrastructure, and the malware observations.
- The Second Life of Expired Domains (opens in a new tab)
Infoblox Threat Intel · August 13, 2026
Supports: Primary research explaining dropcatch registration and how expired domains can retain reputation, connections, and residual traffic after ownership changes.
- Expired domains are a goldmine for hackers – and some cyber crime groups are investing millions in dropcatch scams to deliver malware (opens in a new tab)
ITPro · August 14, 2026
Supports: Independent reporting on the Infoblox findings, including the estimated nature of the $7 million figure and the reported malware connections.
- Effects of perceptual fluency on judgments of truth (opens in a new tab)
Consciousness and Cognition
Supports: Primary psychology study showing that easier-to-read statements were more likely to be judged true. It supports the general fluency mechanism, not a causal claim about Sable Squirrel or any visitor to its domains.
Related cases
Video breakdownThe Medical Scam That Knows Your Real Information
Madera Community Hospital’s notice shows how accurate personal and health details can make a false approach feel pre-verified. The safer habit is to verify healthcare requests through a separate channel you control.