An unrelated spam investigation led us back to infrastructure preserved in our published DNS Attribution Laundering dataset. The overlap does not establish common control or confirm a new case of attribution laundering, but it shows how historical research can create valuable investigative pivots.

When we published our research on DNS Attribution Laundering, our immediate goal was to document an unusual infrastructure pattern discovered while investigating email spam. Trusted university hostnames were connected through DNS to unrelated external infrastructure, potentially causing receiver-generated telemetry to associate institutional names with SMTP systems the institutions did not operate.

Following those relationships produced a much larger graph. The Utah-seeded infrastructure expansion, collected on July 13, 2026, contained 1,449 IP records, 412 domain records, and 3,487 lineage relationships spanning 42 countries and 161 ASN/provider groups.

We published the research and its underlying dataset so others could inspect the evidence independently. It was a point-in-time record of observed relationships—not a list of confirmed malicious assets.

A few weeks later, that distinction became especially important.

A new spam investigation

On August 15, 2026, we received a gambling-themed spam message promoting free spins and a bonus. Its call to action appeared to point to Google infrastructure:

https://storage.googleapis.com/redirectss/leaad.html#...

Instead of opening the destination in a browser, we retrieved the Google Cloud Storage object directly. It contained a single JavaScript redirect:

document.location.href =
  'http://teste.dratspiaro.com/' +
  window.location.href.split('#')[1];

The script appended everything after the fragment marker in the original URL to a URL under teste.dratspiaro.com. That allowed us to reconstruct the next step without requesting it. We deliberately stopped there rather than interact further with potentially harmful infrastructure.

The redirect mechanism matters because the visible URL began under storage.googleapis.com, while JavaScript ultimately transferred the browser elsewhere. But the next observation was what led us back to our earlier research.

An IP address we had seen before

At the time of our investigation, dratspiaro.com resolved to 172.245.211.66. The domain had been created on May 25, 2026, leaving relatively little history to examine, but its mail configuration provided another lead.

Its SPF record explicitly authorized three adjacent addresses:

v=spf1 a mx ip4:172.245.211.66 ip4:172.245.211.67 ip4:172.245.211.68 -all

The middle address was familiar. 172.245.211.67 appears in the dataset published with our DNS Attribution Laundering research.

During the original Utah-seeded expansion, we reached that address through this observed DNS relationship:

mx3.limc.ufrj.br
        |
        | A record
        v
172.245.211.67

That relationship occurred at depth four in the infrastructure graph. The dataset also recorded mx3.limc.ufrj.br resolving across a large collection of addresses on many networks.

Weeks later, a domain encountered independently during a new spam investigation was explicitly authorizing one of those previously observed addresses in SPF. That direct configuration relationship is more useful than merely finding two numerically adjacent IP addresses.

Supporting observations, not proof

We also examined the web infrastructure associated with 172.245.211.66. It hosted a templated website that appeared to contain republished news content. Web infrastructure on 172.245.211.67, as well as another address observed during the earlier research, 172.245.211.69, displayed conspicuous structural similarities: dark navigation, IP-address branding, typography, page structure, and news presentation.

Visual similarity does not establish common ownership or operation. Templates can be copied, reused, or deployed independently. Alongside the explicit SPF relationship, however, the similarities supplied another reason to investigate.

We also observed that wildcard DKIM selector lookups for the new domain returned the same key, meaning arbitrary selectors beneath its _domainkey namespace resolved to the same DKIM material.

None of these observations establishes attribution on its own.

What the evidence does—and does not—show

We do not have sufficient evidence to classify dratspiaro.com or this spam campaign as another confirmed instance of DNS Attribution Laundering.

The original research examined a specific attribution problem: DNS relationships involving trusted institutional hostnames could make unrelated infrastructure appear associated with those institutions in receiver-generated SMTP telemetry. We have not demonstrated that same mechanism in this investigation.

Nor does an address appearing in our dataset mean that every system associated with it was malicious when the dataset was collected. The dataset preserves infrastructure relationships and the paths through which we reached them. It does not transform every domain or IP in the graph into an indicator of confirmed malicious activity.

The narrower conclusion is:

Infrastructure associated with a new spam campaign directly overlaps with infrastructure documented during our earlier DNS Attribution Laundering research.

The historical dataset gave us context we would not otherwise have had. It generated better questions; it did not automatically answer them.

Research as an investigative resource

Had we first encountered 172.245.211.67 in this investigation, it might have appeared to be only another address authorized by a suspicious domain. Because we had preserved the earlier graph, we could ask:

  • Where had we previously seen this address?
  • Which DNS relationship led us there?
  • What infrastructure surrounded it at the time?
  • Did the new infrastructure share characteristics with earlier observations?

These are investigative pivots created by historical research.

Infrastructure changes constantly. Domains are registered and abandoned, DNS records change, addresses are reassigned, and hosting environments move. Point-in-time datasets are therefore imperfect by definition, but they are not disposable.

Historical relationships can help investigators recognize patterns, prioritize leads, and understand how a newly observed asset intersects with earlier evidence. The essential boundary is that those relationships generate questions, not automatic conclusions:

  • An IP address appearing in an old dataset is not proof of maliciousness.
  • A similar website is not proof of common control.
  • Two investigations intersecting does not prove that the same actor is behind both.

When independent signals converge, earlier research can still show investigators where to look next.

Responsible disclosure

We reported the Google Cloud Storage object involved in this campaign to Google on August 16, 2026 and requested review of the hosted redirect content for abuse.

This was not the first similar Google-hosted redirector we had reported. We submitted another Google Cloud Storage abuse report on July 17, 2026. The content from that earlier report has since been removed and is no longer accessible, although we cannot establish from that observation alone that our report caused its removal.

We will apply the same standard to the current investigation: any eventual action by Google must remain distinct from what we can independently observe.

The study continues

Publication did not end the DNS Attribution Laundering investigation. It left behind a body of evidence that could be revisited.

Weeks later, an unrelated spam investigation intersected with that evidence. A newly encountered domain explicitly referenced an address preserved in the research dataset, while associated web infrastructure supplied additional—but non-conclusive—similarities.

This is not a confirmed new case of DNS Attribution Laundering. It does suggest a useful extension for future research: preserve and analyze SPF, DKIM, and DMARC records alongside the DNS relationships already captured in the dataset.

The broader lesson is simple:

Security research becomes more valuable when its findings help investigate the next incident, not only explain the last one.

That is what we are beginning to see with the DNS Attribution Laundering dataset.