In August 2024, we published a list of subdomains a spam gang had quietly taken over through dangling DNS records — expired CNAMEs at universities, global brands, telecoms, and a Connecticut state website. On November 5, 2026, SH Consulting published research on 25,964 US government-related domains. It found 43 whose DNS records still trust expired, mistyped, or repurposed domains. One typo, in Livingston County, Michigan’s SPF record, authorizes at least 32,066 IPv4 addresses to send email as the county. 

The operator behind it is the same group we have tracked for years. Dark Reading covered the research the same day, and while the headlines focus on government, dangling DNS is not a government problem. It is a trust problem in every network that publishes DNS records or accepts email — which means it is your problem too, whether you run a telecom, an ISP, a mailbox platform, or a hosting and cloud business.

This article covers what we found in 2024, what the new research adds, what it means for your network in the short and long term, and how Abusix customers are already protected.

2024: a spam gang hiding in other people’s subdomains

While testing the rebuilt backend of what is now Abusix Mail (formerly known as Guardian Mail), we saw well-known domains appear in detections tied to a spam gang our team had tracked for years. Customers who shared anonymized SMTP transaction data with us helped us track this group.

The gang was using a dangling CNAME attack. A company’s DNS still points a subdomain at a hostname on a domain that has since expired. The attacker registers that expired domain, sets up infrastructure on it, and effectively owns the subdomain. That opens the parent domain to phishing, malware, cookie harvesting, and reputational damage.

In this case, the gang used the hijacked subdomains to send spam, phishing, and malware while making them look legitimate. The affected list included:

• Telecoms and ISPs: Vodafone Italy, KPN, Orange Belgium, and Tiscali Italia
• Hosting: kingHost
• Universities: UCLA, UC Davis, UC San Diego’s Supercomputer Center, and UC Santa Cruz, among many others
• Government: Connecticut’s official state website

We copied the relevant security teams and published the full list instead of keeping it to ourselves. Our products automatically tracked and listed all the active infrastructure we could attribute to the gang, much of it unique to our service.

“We published that list in 2024 because keeping it to ourselves wouldn’t have given a single subdomain back to its owner. Two years later, the same operators appear in government email records. Sharing what we see is how the internet gets safer, faster.” — Tobias Knecht, Founder and CEO, Abusix

2026: the same spam gang, now inside a county’s SPF record

SH Consulting scanned 25,964 government-related domains in June and October 2026: 16,984 ending in .gov and 8,980 on other top-level domains. It found 43 whose SPF, MX, NS, or DMARC records reference domains outside the organization’s control. It defensively registered 17 of those domains and reported its findings to CISA and MS-ISAC.

The sharpest example is Livingston County, Michigan. The SPF record for milivcounty.gov includes amzonses.com — Amazon SES’s domain, amazonses.com, missing one letter. 

According to SH Consulting:

• The typo domains include a chain that led to 8 records with 760 entries, authorizing at least 32,066 unique IPv4 addresses to send as the county.
• Every IP tested returned SPF pass and DMARC pass against the county’s configuration.
• The typo domain’s SPF include chain changes every 3 to 8 days. That is a sign of a snowshoe operation, which spreads sending across many IPs and swaps them for new ones once they are blocklisted.
• Almost all of the IPs tied to amzonses.com are listed by reputable blocklist operators, Abusix among them.

Abusix confirmed to SH Consulting that this is the group we documented in 2024. Steve Freegard, Senior Product Owner, Abusix Intelligence, told the researchers we have run a dedicated processor listing this group’s IPs for years.

The research found the same weakness in other record types. One nameserver for vacstclairil.gov points to ns41.domancontrol.com, a misspelling of GoDaddy’s domaincontrol.com. Some typo MX domains are already set up to accept incoming mail. Eight unregistered DMARC reporting domains were set to receive reports for 11 government institutions.

In Dark Reading article from November 5, 2026, they described the group behind the Livingston County typo and how it linked to our 2024 research and named victims from our list: Oracle, CNN Money, four University of California campuses, and the Connecticut state government. 

SH Consulting founder Alex Shakhov told Dark Reading that with DNS typos, “the organization is being hacked without anyone breaking into its systems.” He added that across millions of domains his team scanned this year, 47% of unregistered domains found in SPF and DMARC records were typos.

“This group swaps its SPF infrastructure every few days, so a one-off audit or a static allowlist won’t keep up. What works is watching the sending infrastructure itself. We’ve listed their IPs for years, so our customers were blocking this traffic long before the county’s record made the news.” — Steve Freegard, Senior Product Owner, Abusix Intelligence

What dangling DNS means for telecoms, ISPs, hosting and cloud providers

If you run a network, you sit on both sides of this problem. Your mail servers receive email from domains with broken DNS, and your IP space may host the infrastructure that exploits it.

In the short term:

• A pass is not proof. The county’s mail passed SPF and DMARC because the county’s own record authorized the sender. DMARC only needs SPF or DKIM to pass, so a filter that leans on authentication results delivers this mail to the inbox. Your customers then see a trusted sender that is not who it claims to be.
  
• Snowshoe traffic lands on your network. The spam gang’s infrastructure spans many providers. In 2024, IPs behind the hijacked CNAMEs were hosted across many networks; the 10 busiest held between 29 and 215 each. When those IPs sit in your ranges, network abuse reports, blocklistings, and support tickets follow.
• Your own zones are in scope. Telecoms and a hosting provider were on our 2024 list. A forgotten CNAME from a past campaign or vendor is enough for an attacker to register the expired domain behind it and send spam, phishing, and malware from your subdomain.
  

In the long term:

• Records outlive the vendors behind them. Domains expire, providers change, and the DNS entries stay. SH Consulting found typo domains anyone can buy, one listed for $350.[2] The cost to an attacker stays low while the trust they inherit stays high.
• Attackers scan DNS in bulk. Shakhov told Dark Reading that attackers constantly scan DNS records because it is one of the cheapest ways into someone’s infrastructure, and that Certificate Transparency logs expose most subdomains. Every customer zone you host adds to what they can find.
• Authentication alone won’t close the gap. SPF, DKIM, and DMARC tell you a domain vouched for a sender. They don’t tell you whether the sender is trustworthy. Reputation data at the connection layer is what fills that gap.

“Every network inherits the DNS mistakes of the domains that send to it and the customers it hosts. Authentication tells you a domain vouched for a sender. It doesn’t tell you the sender deserves that trust. That’s the gap our data closes for network operators every day.” — Tobias Knecht, Founder and CEO, Abusix

How Abusix customers are already protected

If you use Abusix, we’ve had this spam gang’s traffic on our radar long before the county’s SPF record made headlines. Here is how each Abusix product helps protect our customers.

• Abusix Mail blocks the sender, whatever its SPF record says. Abusix Mail checks the sending infrastructure’s reputation in real time. We have run a dedicated processor listing this group’s IPs for years, and its active infrastructure is tracked and listed automatically, much of it unique to our service. Because the check looks at who is actually connecting, a passing SPF or DMARC result doesn’t let a listed IP through.
• Abusix Ops helps hosting and cloud providers act fast. When snowshoe infrastructure lands in your IP ranges, Abusix Ops ingests, correlates, and acts on network abuse events automatically, so your team can shut down the misuse without triaging every report by hand.
• Abusix Intel shows you the threat behind an IP or domain. Abusix Intel draws on over 12 billion live threat indicators a day. SH Consulting used Abusix’s lookup to show one IP from the amzonses.com chain flagged as malicious.
• Our data gets better because customers share. The 2024 discovery started with anonymized SMTP transaction data our customers contribute. Every network that shares makes detection faster for all of them.

That matters for the networks we serve. Abusix customers include 7 of Europe’s 10 largest telecoms, alongside ISPs, mailbox providers, and cloud and hosting companies across North America, EMEA, and APAC.

“Typo domains and dangling records will keep appearing because people keep typing DNS by hand. You can’t fix every zone on the internet. You can make sure the infrastructure exploiting them never reaches your users.” — Steve Freegard, Senior Product Owner, Abusix Intelligence

Closing the gap: the actions you can take

Dangling DNS is cheap to exploit and cheap to fix. Start with your own zones, then the zones you host.

1. Resolve every SPF include. Check each domain in your SPF records character by character. A missing letter, hyphen, or dot can hand your sending rights to a stranger. Copy and paste vendor hostnames instead of typing them.
2. Check CNAME, MX, and NS targets. Any record pointing to a domain you or a current vendor doesn’t control should go.
3. Own your DMARC reporting endpoints. Make sure the domains in your rua and ruf tags are registered to you or your provider.
4. Clean up when vendors change. Remove records for retired campaigns, tools, and providers as part of every off-boarding.
5. Register likely misspellings of your own domains. Dark Reading recommends this so attackers can’t buy them first.
6. Audit on a schedule. Shakhov recommends at least a quarterly DNS review; a simple script that flags invalid domains is enough to start.
7. Don’t treat a pass as trust. Layer real-time IP and domain reputation on top of SPF, DKIM, and DMARC checks.
   
8. Watch your IP ranges. Hosting and cloud providers should act quickly on network abuse reports tied to rotating, short-lived senders.

This research began as a single anomaly in our 2024 detections. Two years later, it reached government email records, independent researchers, and Dark Reading. The pattern will keep repeating because DNS records outlive the people and vendors who created them.

Want to see what Abusix sees? Check any IP, domain, or URL with our free Abusix Lookup, or talk to Abusix about protecting your network and your customers.