Sitting Ducks and Scammy Notifications: Inside a Global Malvertising Operation

Researchers at Infoblox have uncovered a massive, deceptive push-notification network built on hijacked, abandoned domains to flood users with scam alerts. The investigation details how the so‑called Sitting Ducks vulnerability enabled threat actors to claim dormant domains and passively receive traffic from millions of devices, increasing from one domain to nearly 120 within a day and generating about 30MB of logs per second.

Over a two‑week period, more than 57 million logs were collected, with victims largely on Android Chrome and an average of 140 notifications per day. Campaigns ran worldwide in more than 60 languages, with half of all traffic attributed to Bangladesh, India, Indonesia and Pakistan, according to the analysis.

Content ranged from fake virus alerts and faux scandals involving public figures to impersonations of legitimate financial services, while overall profitability appeared modest at around $350 per day; the click‑through rate averaged just 1 in 60,000. The report warns that the Sitting Ducks vulnerability continues to threaten DNS hygiene and that domain owners bear responsibility for securing their records.