Infoblox Exposes Scam Push-Notification Network via DNS Lame Delegation (“Sitting Ducks”) Domain Takeover

Infoblox researchers reported that a large-scale scam push-notification operation targeting primarily Android Chrome users was partially exposed after the threat actor made a DNS configuration error that left domains in a lame delegation state (a “Sitting Ducks” condition). By legitimately re-claiming an abandoned actor-controlled domain at its DNS provider—without accessing victim devices or the attacker’s servers—the researchers redirected notification and tracking traffic to infrastructure they controlled, gaining a live view of the criminal ecosystem behind the deceptive browser-notification spam.

Telemetry collected from victim browsers included rich JSON-style request data (e.g., device and locale details, lure text, and click behavior) and showed sustained, high-volume abuse: users could receive 100–140+ notifications per day for extended periods, with lures ranging from fake security alerts to gambling and adult content. Reporting indicates the researchers expanded collection from a single domain to nearly 120 domains, capturing tens of millions of records (including a cited figure of ~57 million logs over two weeks) and observing global activity across 60+ languages, with traffic heavily concentrated in South Asia (notably Bangladesh, India, Indonesia, and Pakistan).