Somewhat related, I've been getting a lot of spam with links to urls of big, reputable, organizations, such as universities.
You'd think that the organization was hacked, but in all these case instead these were old domains that used CNAMEs.
The domain that the CNAME pointed to was once owned and used by the organization, but at some point it was let go, and it ended up being purchased by the spammers.
So, the spammers were able to use links that looked safe, and maybe that also helped with passing spam filters.
Thus, if you manage domains, please keep track of the ones with CNAMEs, recommend the users to tell you when they stop using them, and maybe check every once in a while (better if automatically) that the domain they're pointing to hasn't changed hands.
I'd be curious to know how the spammers find these old cname domains, by the way.
And many of them provide analytics to see who’s clicking your link.
Or for historical context, this is all Twitter's fault since its character limit included links too.
Imagine is someone is using curl | bash on a shortened URL because "its too long" and you can't see where the link it going.
You'd think that the organization was hacked, but in all these case instead these were old domains that used CNAMEs.
The domain that the CNAME pointed to was once owned and used by the organization, but at some point it was let go, and it ended up being purchased by the spammers.
So, the spammers were able to use links that looked safe, and maybe that also helped with passing spam filters.
Thus, if you manage domains, please keep track of the ones with CNAMEs, recommend the users to tell you when they stop using them, and maybe check every once in a while (better if automatically) that the domain they're pointing to hasn't changed hands.
I'd be curious to know how the spammers find these old cname domains, by the way.
https://x.com/realdonaldtrump/status/228935671061020673?a=87...
https://x.com/realdonaldtrump/status/350628162595590148?a=Jk...