What happened
- Guardio Labs published its SubdoMailing research on Feb 26, 2024.
- It reported 8,000+ hijacked domains, with "hundreds" added daily, sending millions of spam emails a day.
- The activity had been ongoing since at least late 2022.
- Guardio attributes it to an actor it calls "ResurrecAds".
Root cause, per the sources
Per Guardio, the attackers registered abandoned domains that dangling CNAME records pointed to, and took over defunct domains listed in SPF records.
The exposure behind it
A DNS record that still points at something nobody owns anymore can be claimed by someone else. An SPF record that still authorizes a defunct domain can give that domain the right to send as you. Both are visible in public DNS.
What PixelPrivate can check
Dangling CNAME check
We check www and common subdomains for CNAME records that point to names that no longer resolve. It is an indicator for review, not proof of takeover.
Learn moreSPF checks
We check that an SPF record exists, is valid, is not duplicated and stays within the 10-lookup limit. We do not yet check whether included domains still exist (Roadmap).
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We cannot tell whether anyone has abused a stale record.
- We cannot claim that PixelPrivate would have prevented this incident, and we do not claim that.
What to do this week
- Review your DNS for records pointing at services you stopped using.
- Remove SPF includes for vendors you no longer use.
- Remove DNS entries when you decommission a service, as part of the checklist.
Sources
- Guardio Labs, “SubdoMailing: thousands of hijacked major brand subdomains found bombarding users with millions of emails”, Feb 26, 2024. https://guard.io/labs/subdomailing-thousands-of-hijacked-major-brand-subdomains-found-bombarding-users-with-millions
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
How were the domains taken over?
Per Guardio, attackers registered abandoned domains that dangling CNAME records pointed to, and took over defunct domains listed in SPF records.
Does PixelPrivate say who is behind it?
No. Guardio attributes the activity to an actor it calls ResurrecAds. We report only that.
Can PixelPrivate tell if my subdomain was abused?
No. It can flag a CNAME that points to a name that does not resolve. It does not yet check SPF includes for defunct domains, and it cannot tell whether anyone used a stale record.
