Threats I hunted
SubdoMailing
A sprawling spam operation that hijacked thousands of abandoned subdomains from MSN, VMware, McAfee, and eBay to send millions of authenticated emails.
- 8,000+
- hijacked domains & subdomains
- 13,000+
- subdomains weaponized
- Red Sift & Spamhaus
- built scanners around the name
A spam factory exploited abandoned CNAME and SPF records of world-famous brands pointing at decommissioned servers. Attackers claimed the dangling IP addresses and sent emails with valid SPF authentication.
We mapped the entire factory — over 8,000 domains and 13,000 subdomains — coining the term SubdoMailing. The security community responded globally: Spamhaus, NJCCIC, and Red Sift developed dedicated scanners and advisories.
In the press
BleepingComputerHijacked subdomains of major brands used in massive spam campaign The Hacker News8,000+ Subdomains of Trusted Brands Hijacked in Massive 'SubdoMailing' Spam Operation Dark ReadingEBay, VMware, McAfee Subdomains Hijacked in Sprawling Phishing Operation ForbesSubdoMailing Threat To New Gmail Security Rules KasperskySubdoMailing campaign: hijacking domains for spamming SecurityWeekDomains Once Owned by Major Firms Help Millions of Spam Emails Bypass Security CPO MagazineMassive Ad Fraud Campaign Sends Million of Spam Emails from Thousands of Hijacked Reputable Domains
Read the research
EchoSpoofing