Post #4240809
2026-07-30 12:45 UTC
Spamhaus keeps observing internet abuse involving dangling CNAME DNS records, a threat we first highlighted in 2024: 👉️ https://www.spamhaus.org/resource-hub/dns/dangling-dns-and-the-dangers-of-subdomain-hijacking/
A long-standing threat actor is currently disseminating snowshoe spam from about 2.5k IPv4 addresses, leveraging dangling CNAMEs. While our CSS & DBL datasets cover this campaign, our ticket team encounters a steady stream of domain owners (whose dangling CNAMEs are actively abused) wondering why their legitimate domains' reputation deteriorated. 🧐 ⤵️
Replies (1)
-
@spamhaus@infosec.exchange 2026-07-30 12:45
If you oversee an organizations' domain petting zoo, we strongly recommend implementing (in addition to the robust monitoring, compliance and internet asset decommissioning procedures you undoubtedly have in place 😉) periodic checks against Spamhaus DBL – particularly for domains outside your control, such as third-party services used as CNAME targets. Any DBL listing indicates an ongoing abuse incident, and should prompt an investigation. 2/3