Infoblox Finds Dropcatch Domains Make Up Nearly 20% of New gTLD Registrations
Summary
Infoblox observed about 50,400 re-registered dropcatch domains daily across gTLDs in the first half of 2026. These domains can inherit reputation and lingering connections that threat actors may abuse.
Key points
- Infoblox observed an average of about 50,400 daily dropcatch domains in gTLDs and around 65,000 when ccTLDs were included; dropcatch activity accounted for about 20% of registrations.
- About 92% of observed dropcatch domains came from 15 gTLDs; nearly three in ten newly observed .net and .xyz domains had existed before.
- The analysis identifies dropcatch domains by combining new creation dates with Infoblox’s historical domain records; limited creation-date availability makes measurement harder, especially for ccTLDs.
- A dropped domain can be re-registered through backorders, drop-catching services, auctions, or direct registration after release.
- New owners may inherit reputation, email intended for the former owner, cached search results, traffic, or lingering DNS connections, creating potential security risks.
- Infoblox describes a former marketing-service CDN domain acquired by Shady Squirrel in February 2026; the actor began redirecting website visitors to malware.
Article Details
- Publisher
- Infoblox Threat Intel
- Report Period
- First half of 2026
- Scope
- Dropcatch activity across gTLDs and ccTLDs, domain-registration lifecycle, and associated security risks.
- Sample Size
- Not disclosed
- Key Statistics
- An average of 50,400 dropped domains were re-registered daily across gTLDs during the first half of 2026.
- Including ccTLDs, about 65,000 dropcatch domains were detected daily.
- Dropcatch domains accounted for nearly 20% of observed daily gTLD registrations; the overall share including ccTLDs was also about 20%.
- Approximately 92% of observed dropcatch domains came from 15 TLDs.
- Dropcatch rates were nearly 30% for .net and .xyz registrations and 24.5% for .com.
Threat Actors
Sable SquirrelInfoblox describes Sable Squirrel as a threat actor that has spent millions of dollars acquiring dropped domains; the article says its activity will be examined in a subsequent installment.Shady SquirrelInfoblox reports that in February 2026 the actor acquired an expired CDN domain and began sending website visitors to malware.