Monitoring Finds 79 Parked Real Estate Domains Sending Unauthorized Email
Summary
Monitoring 364 domains belonging to a real estate team found 79 parked domains sending unauthenticated email. The publisher says DNS lockdown records reduced delivery, with remaining spoofed messages rejected by mailbox providers.
Key points
- The publisher reports that DMARC monitoring of 364 domains belonging to The Ashton Real Estate Group found unauthorized email from 79 supposedly dormant domains.
- The observed messages failed SPF and DKIM authentication; the publisher says their source IPs came from more than a dozen countries.
- The publisher describes sparse traffic from residential ISP ranges across multiple countries as a pattern consistent with botnet activity.
- For domains that should never send email, the article recommends null MX, SPF set to -all, an empty wildcard DKIM key, and DMARC set to p=reject.
- After the DNS changes, the publisher reports 43 remaining messages in the following five weeks, all rejected by mailbox providers.
Article Details
- Defense Focus
- Detect unauthorized email claiming to come from parked domains, then prevent delivery by enforcing email-authentication policies and maintaining monitoring.
- Detection Methods
- Enable DMARC aggregate reporting across the full domain portfolio to identify messages claiming to come from each domain.
- Review SPF and DKIM authentication failures, sending IP addresses, resolved sending hostnames, and mailbox-provider dispositions.
- Compare reported unauthorized-mail volumes before and after policy enforcement.
- Data Sources
- DMARC aggregate reports from mailbox providers
- SPF and DKIM authentication results
- Source IP addresses and sending-hostname resolution
- Mailbox-provider quarantine or rejection dispositions
- Rule Types
- Null MX record for domains that should not receive mail
- SPF deny-all record: v=spf1 -all
- Empty wildcard DKIM key to revoke leftover signing keys
- DMARC policy set to p=reject
- Platforms
- Gmail
- Microsoft
- Yahoo
- Mail.Ru
- Defensive Actions
- Inventory domains across registrars and accounts, including legacy registrations.
- Separate domains that legitimately send email from domains that should send none.
- Apply the null MX, SPF deny-all, empty wildcard DKIM, and DMARC reject records to unused domains.
- Keep DMARC monitoring enabled and verify that domains are properly configured before returning them to use.
People
Countries
Australiatraffic across the dormant portfolio by source country over 90 days. China and Russia lead, followed by Australia, the US, and Brazil.What was in these messages? Aggregate DMARC reports show the traffic, not theBrazilportfolio by source country over 90 days. China and Russia lead, followed by Australia, the US, and Brazil.What was in these messages? Aggregate DMARC reports show the traffic, not the message bodies, but thisBulgariaA single view of the incoming reports: unauthenticated mail claiming to come from the team's dormant domains, from source IPs in Russia, Korea, India, Vietnam, Bulgaria, Brazil, and China.ChinaWe Monitored 364 Domains Owned by One of America's Top Real Estate Teams. 79 Were Sending Emails From China, Russia, and a Dozen Other Countries.IndiaA single view of the incoming reports: unauthenticated mail claiming to come from the team's dormant domains, from source IPs in Russia, Korea, India, Vietnam, Bulgaria, Brazil, and China.KoreaA single view of the incoming reports: unauthenticated mail claiming to come from the team's dormant domains, from source IPs in Russia, Korea, India, Vietnam, Bulgaria, Brazil, and China.RussiaWe Monitored 364 Domains Owned by One of America's Top Real Estate Teams. 79 Were Sending Emails From China, Russia, and a Dozen Other Countries.United StatesWe scanned 25,964 US government domains and found 43 whose SPF, MX, NS or DMARC records still point to expired, mistyped or repurposed domains. One typo lets 32,066 IP addresses send email as a Michigan county.VietnamA single view of the incoming reports: unauthenticated mail claiming to come from the team's dormant domains, from source IPs in Russia, Korea, India, Vietnam, Bulgaria, Brazil, and China.
Industries
Manufacturingon LinkedIn.This isn't just a real estate problem, either. We've found the same pattern in both manufacturing and sports venues, as well as in our earlier research into hijacked university subdomains. Whenreal estateWe Monitored 364 Domains Owned by One of America's Top Real Estate Teams. 79 Were Sending Emails From China, Russia, and a Dozen Other Countries.sports venuesisn't just a real estate problem, either. We've found the same pattern in both manufacturing and sports venues, as well as in our earlier research into hijacked university subdomains. When organizations accumulate