Things have been very busy around here lately; this week, we’ve quietly released a completely re-written and re-architected backend to our Guardian platform using the experience that we’ve gained in the 5 years since it was first launched and has taken over a year to complete.

This new backend will provide the foundation for Guardian Mail to continue to grow over the coming years, and has already provided some interesting discoveries, and one that I want to share with you now.

Blocking A Spam Gang

For some years now, the team and I have been tracking a fairly prolific spam gang, who have been relatively successful in evading other companies’ spam detection but we have been successfully blocking, thanks to many of our customers sharing anonymised SMTP transaction data with us to help us track this gang.

During the recent testing phase of our new processing infrastructure; we started to see popular domains unexpectedly appearing in our detections related to this particular spam gang.

Upon closer inspection, we discovered that they had taken over portions of some very popular domains by means of dangling CNAME attacks.   This is where an attacker discovers a CNAME in a company’s domain which points to a hostname of a domain that has expired, they then register that domain name and set-up infrastructure on that hostname, effectively taking over the sub-domain for themselves.

This is obviously very dangerous for the domains concerned because it opens them up to Phishing and Malware attacks, cookie harvesting, and reputational damage.

Abusix Does Not Gatekeep

Luckily for these domains, in this case, this particular gang appears to simply use the domains to “fly under the radar” to send spam, phishing and malware to others, rather than using these to attack the parent domain, which would likely be far more damaging.  They also mixed the infrastructure, making it easier for us to discover other CNAMEs that they had taken over.

At Abusix, rather than gatekeep intelligence like this, our goal is to get stuff shared and taken down, so we’ve copied all the relevant security teams with this information and we’re providing it here to make it known to others.

Here is the list of affected entities, the hostnames and CNAMEs that they point to:

All of the active infrastructure of this gang is automatically tracked and listed by our Guardian products, much of it unique to our service.

The IPs that the CNAMEs point to are hosted in various places; but using our ContactDB service to normalize the IPs by Abuse desk; the top 10 networks are:

• 215 [email protected]
• 56 [email protected]
• 47 [email protected]
• 41 [email protected]
• 39 [email protected]
• 37 [email protected]
• 36 [email protected]
• 35 [email protected]
• 31 [email protected]
• 29 [email protected]

Most of the domains registered for the purposes of the CNAME takeover used NameCheap, WildWestDomains and two used Dynamic IP name services ddns.net and dyndns.org.

It should also be noted that many of the SPF records published on these CNAMEs are pointed to domains hosted by Cloudflare (healtheweb.co.uk) along with several eu.org sub-domains in which Cloudflare is also used for name services.

Let this post serve as a reminder to check your DNS for dead CNAMEs that should be removed, otherwise your domain could end up being used in this way!

Lastly, if you are receiving abuse but you don’t have the time or patience to report it, then we want to help!   You can use our free Global Reporting service; you send us the abuse report which we will validate to make sure all the basic requirements are met and then send it to the appropriate abuse desk on your behalf.

We can also do the same with user feedback from your email system; if you have a “Report Spam” function, then you can report this to us and we will report as a Feedback Loop to the originating mail system, provided they abide by RFC9477 and we know they’re trustworthy.

You can find out more about both of these services on our website.