Right now, as you read this, someone could be sending emails from your domain. They could be hosting a phishing page on one of your forgotten subdomains. They could be in the process of transferring your domain to a registrar in another country. And you would not know, because you are not watching.

This is not fear mongering. This is what happened to the CDC, MSN, eBay, Marvel, McAfee, VMware, PricewaterhouseCoopers, Cornell University, and thousands of other organizations. Not because they had weak passwords or got tricked by phishing emails. Because they had DNS records pointing to resources they forgot about, and nobody was monitoring those records for changes.

The Attacks That Already Happened to Organizations Like Yours

In February 2024, Guardio Labs uncovered a campaign called SubdoMailing that had hijacked over 8,000 domains and 13,000 subdomains belonging to major brands. The hijacked domains were being used to send five million fraudulent emails per day. The emails passed every spam filter because they were technically authorized by the real domain's DNS records. The brands included MSN, eBay, McAfee, Marvel, CBS, The Economist, Unicef, and Pearson. None of them knew it was happening.

The attack worked because these organizations had old DNS records (CNAME entries and SPF configurations) pointing to services they had cancelled or abandoned. The attackers simply re-registered those abandoned services and inherited the trust of the parent domain. No hacking was required. No passwords were stolen. The DNS records did all the work.

In May 2025, a threat actor called Hazy Hawk used the same technique to take over subdomains belonging to the U.S. Centers for Disease Control and Prevention. Government subdomains, the kind that carry implicit trust with the public, were serving scam content because a cloud resource had been decommissioned but the DNS record pointing to it was never removed.

In April 2026, the DNS records for CoW Swap, a cryptocurrency exchange processing roughly $700 million in weekly volume, were modified to redirect every visitor to a phishing site. The team did not discover the hijacking for 47 minutes. By the time they regained control, users had lost an estimated $500,000 or more in stolen funds.

In the same month, the U.S. Department of Justice disrupted a Russian military intelligence operation that had compromised DNS settings on over 5,000 devices across 120 countries. The attackers were silently redirecting email login pages to credential harvesting servers. The campaign had been running since at least August 2025.

These are not isolated incidents. They are the ones that made headlines. The ones that never make headlines are the small businesses, the startups, the ecommerce stores, and the personal brands whose domains quietly get hijacked, used, or impersonated without anyone noticing for weeks or months.

Why You Think This Will Not Happen to You (and Why That Thinking Is Wrong)

"I am too small to be a target." The SubdoMailing attackers did not hand pick their 8,000 victims. They used automated scanning tools to find any domain with an exploitable DNS record. Attackers do not care how big you are. They care how easy you are. A domain with a dangling CNAME record is equally exploitable whether it belongs to eBay or a five person startup.

"My registrar handles security." Your registrar stores your domain registration. That is all. They do not monitor your DNS records for unauthorized changes. They do not check whether your CNAME records point to abandoned cloud resources. They do not alert you when your SPF record is misconfigured in a way that lets anyone send email as you. Registrar lock prevents unauthorized transfers. It does not prevent DNS record exploitation.

"I would notice if something changed." CoW Swap's engineering team, people whose full time job is managing internet infrastructure, did not notice for 47 minutes. The organizations hit by SubdoMailing did not notice for months. The CDC's compromised subdomains were exploited by Hazy Hawk for weeks before Infoblox discovered them. If these organizations with dedicated security teams did not notice, how would you?

"I do not have subdomains." If you have ever connected a custom domain to Shopify, Squarespace, GitHub Pages, Heroku, AWS, Azure, Netlify, Vercel, Webflow, Mailchimp, or any other cloud service, you probably created a CNAME or A record. If you later cancelled that service but did not delete the DNS record, you have a dangling record. If you have ever set up Google Workspace, Microsoft 365, or any email service, you have SPF, DKIM, and DMARC records in your DNS. If those records reference services you no longer use, they are exploitable.

"I set it up correctly years ago." DNS is not a "set and forget" system. Your records can be changed by anyone who gains access to your registrar account or DNS provider. Your cloud provider can deprecate the service your records point to. Your domain can expire if a credit card on file is declined and auto-renewal fails. Your email authentication records become exploitable the moment you stop using the service they reference. The configuration that was correct two years ago may be a vulnerability today.

What Monitoring Actually Looks Like (It Takes 5 Minutes)

DNS and WHOIS monitoring is not complex to set up. It is not expensive. And it is not something you need a security team to manage. At its core, monitoring does three things.

First, it watches your DNS records (A, AAAA, MX, NS, TXT, CNAME, SOA, CAA) and alerts you the moment any of them change. If someone modifies where your domain points, if your email records are altered, if your nameserver delegation shifts, you know about it within minutes. Not 47 minutes. Not months. Minutes.

Second, it watches your WHOIS registration data: your registrar, your expiration date, your nameservers at the registrar level, and your contact information. If someone initiates an unauthorized transfer, if your domain is about to expire, if your registrant email gets changed (the first step in most domain theft attacks), you get an alert.

Third, it scans your CNAME records to find dangling entries that point to cloud resources that no longer exist. These are the records the SubdoMailing attackers and Hazy Hawk exploited. They are invisible until someone checks, and most organizations never check.

DNS Assistant does all three. You add your domains, configure which record types to watch and which notification channels to use (email, Slack, Microsoft Teams, webhooks, or SMS), and the system handles the rest. It runs checks at configurable intervals, compares every result against the previous baseline, and fires alerts through your chosen channels when something changes.

The dangling DNS scanner checks your subdomains against fingerprints from 22+ cloud providers and flags anything that an attacker could claim. The WHOIS monitor watches your registration data and alerts on expiration date changes, registrar transfers, nameserver modifications, and contact information updates. The TLS security scanner grades your SSL configuration and alerts on certificate issues. The email authentication monitor tracks your SPF, DKIM, and DMARC health across 28 monitorable fields.

Setting it up takes less time than reading this article.

What It Costs Not to Monitor

The math is straightforward. CoW Swap lost $500,000+ in 47 minutes. Curve Finance was hit by DNS hijacking so many times they abandoned their domain entirely and migrated to a new one. The SubdoMailing campaign sent five million fraudulent emails per day under the names of hijacked brands, damaging their reputation and deliverability in ways that take months to recover from.

For small businesses, the consequences are proportionally just as severe. A hijacked domain means your website serves content you do not control. Your email gets intercepted or your sending reputation gets destroyed. Your customers lose trust. And recovering a stolen domain through ICANN's dispute process or the courts can take weeks to months, during which your business operates without its primary online identity.

CSC's research found that nearly 13% of corporate domain lapses are subsequently re-registered by a third party. When WatchTowr Labs registered 40 expired domains for as little as $20 each, they gained control of 4,000 active backdoors on government and university systems that were still calling home to those domains.

Your domain is not just a URL. It is your email infrastructure. It is your customer trust. It is your search engine rankings built over years. It is your brand. And right now, the only thing standing between you and an attacker exploiting it is whether or not someone is watching.

Start With a Free Domain Scan

We built a free tool that scans your domain and shows you exactly what an attacker would see: DNS record configurations, WHOIS registration data, and email authentication status. No signup required. No credit card. Just enter your domain and see the results.

If the report comes back clean, you lose nothing but two minutes. If it finds something, you just prevented the kind of incident that cost CoW Swap half a million dollars and cost the CDC its reputation on compromised government subdomains.

Run your free domain scan at dnsassistant.com/tools/domain-report

Then, if you want continuous monitoring so you never have to wonder whether something changed while you were not looking, DNS Assistant's monitoring plans start with self-serve onboarding and token-based pricing designed for teams of any size. No enterprise sales calls. No annual contracts. Just protection for the infrastructure your business depends on.

Every organization that got hit by SubdoMailing, Hazy Hawk, Sea Turtle, or the CoW Swap hijacking had one thing in common: they were not monitoring their DNS. That is a choice. And it is a choice you can change today.