Gandalf_The_Grey
Level 76
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Well-known
- Apr 24, 2016
- 6,631
A massive ad fraud campaign named "SubdoMailing" is using over 8,000 legitimate internet domains and 13,000 subdomains to send up to five million emails per day to generate revenue through scams and malvertising.
The campaign is called "SubdoMailing, as the threat actors hijack abandoned subdomains and domains belonging to well-known companies to send their malicious emails.
As these domains belong to trusted companies, they gain the benefit of being able to bypass spam filters and, in some cases, take advantage of configured SPF and DKIM email policies that tell secure email gateways that the emails are legitimate and not spam.
Some notable brands that fell victim to this domain hijacking campaign include MSN, VMware, McAfee, The Economist, Cornell University, CBS, NYC.gov, PWC, Pearson, Better Business Bureau, Unicef, ACLU, Symantec, Java.net, Marvel, and eBay.
These renowned brands involuntarily lend legitimacy to the fraudulent emails and help them pass through security filters.
Clicking on the embedded buttons in the emails takes users through a series of redirections, generating revenue for the threat actors via fraudulent ad views. Ultimately, the user arrives at fake giveaways, security scans, surveys, or affiliate scams.
Guardio Labs researchers Nati Tal and Oleg Zaytsev discovered the ad fraud campaign and reported that the operation has been underway since 2022.
The number of emails reaching targets surpasses 5,000,000 daily. While the attacker's profit from this is impossible to appreciate, the scale of the operation and volume of the fraudulent emails are undeniably massive.
Guardio Labs has created a SubdoMailing checker site that can allow domain owners to detect if their brand is being abused and take action to stop or prevent it.
![www.bleepingcomputer.com](https://www.bleepstatic.com/content/hl-images/2024/02/26/email.jpg)
SubdoMailing campaign spams 5 million emails daily via 8k hijacked domains
A massive ad fraud campaign named "SubdoMailing" is using over 8,000 legitimate internet domains and 13,000 subdomains to send up to five million emails per day to generate revenue through scams and malvertising.