Drop Something? Don’t Worry, Someone Caught it
Infoblox Threat Intel reports that nearly 20% of daily gTLD registrations are dropcatch domains—previously registered domains that expired and were re-registered. Threat actors exploit the inherited reputation and lingering connections of these domains to facilitate malware distribution, phishing, and infrastructure hijacking. Threat actors Shady Squirrel and Sable Squirrel are actively using this technique.
Detection / Hunteropenrouter
What Happened
Every day, thousands of website domain names expire because their owners forgot to renew them or stopped using them. Other people can then buy these expired domains. This is a problem because the old domains keep their good reputation and existing web traffic. Hackers are buying these expired domains to trick security filters and send people to malicious websites or malware. Organizations need to track their domain names carefully to prevent them from falling into the hands of hackers.
Key Takeaways
- Approximately 20% of all daily gTLD domain registrations are dropcatch domains, meaning they were previously registered, expired, and re-registered.
- Threat actors acquire dropped domains to inherit their reputation, cached search results, web traffic, and lingering DNS/email connections.
- Threat actors Shady Squirrel and Sable Squirrel are actively acquiring dropped domains for malicious activities such as malware distribution.
- Domain creation date availability varies by TLD, making large-scale identification of dropcatch domains challenging.
- Organizations risk losing internal domains through missed renewals, which can then be acquired by threat actors or held for ransom.
Affected Systems
- Domain Name System (DNS)
- Web Infrastructure
- Email Infrastructure
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Reconnaissance: Threat actors monitor expiring domains with established reputation, traffic, or lingering DNS/email connections.
- Acquisition: Actors use dropcatch services or auctions to acquire the expired domains immediately upon release.
- Infrastructure Development: The acquired domain is configured for malicious use, inheriting the trust of its previous registration.
- Execution: Actors use the domain to host malware, conduct phishing, or intercept traffic intended for the original owner.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules but discusses the methodology for identifying dropcatch domains at scale using historical WHOIS and DNS data.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | EDR tools are not designed to detect domain registration events or WHOIS changes. |
| Network Visibility | Medium | Network monitoring can detect traffic to newly re-registered domains or changes in DNS resolution for known domains. |
| Detection Difficulty | Hard | Identifying dropcatch domains requires maintaining a historical database of domain registrations and comparing new registrations against it, which is resource-intensive. |
Required Log Sources
- DNS logs
- WHOIS data
- Passive DNS data
- Web proxy logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Domains that have recently changed their creation date in WHOIS records but have historical DNS resolution data may be dropcatch domains. | WHOIS data and Passive DNS | Acquire Infrastructure | Medium - legitimate domain transfers or registrar changes can sometimes alter creation dates. |
| Sudden changes in DNS A records or CNAMEs for long-standing domains to new hosting infrastructure may indicate a dropcatch domain being repurposed. | Passive DNS and DNS resolution logs | Infrastructure Development | Medium - legitimate infrastructure migrations can cause similar changes. |
Control Gaps
- Standard reputation-based security products may falsely trust dropcatch domains due to their inherited history.
- Lack of visibility into domain registration lifecycle and WHOIS history.
Key Behavioral Indicators
- Domain creation date is recent but the domain has historical DNS records.
- Domain was previously registered to a different organization or privacy service.
- Lingering DNS records pointing to the domain from third-party services.
False Positive Assessment
Medium - Many dropcatch domains are acquired for legitimate purposes such as domain investment or brand protection, making it difficult to distinguish malicious from benign re-registrations.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Consider auditing your organization's domain portfolio to ensure all domains are actively managed and renewed.
Infrastructure Hardening
- Evaluate whether your DNS security tools incorporate domain age and historical registration data into reputation scoring.
- Consider implementing monitoring for dangling DNS records within your organization's infrastructure.
User Protection
- If supported by your web filtering tools, consider blocking or closely monitoring domains that have recently changed ownership or re-registered after a long expiration period.
Security Awareness
- Consider training IT and security staff on the risks of expired domains and the importance of timely renewals for internal and external domains.
