-
At that scale, I would treat this as a trust and quality reassessment issue, not just a cleanup task.
If the hacked pages were indexed and associated with spammy behavior, search engines may still be processing that history even after removal. Taking the subdomain offline helps, but it does not automatically restore confidence.
First thing I would verify is whether every compromised URL returns the correct status, whether spam pages are fully deindexed, and whether any residual internal links, sitemaps, or canonical signals still point to affected areas. Then check server logs and Search Console for crawl anomalies and manual action notices.
A reconsideration request only matters if there is a manual action. Otherwise recovery is algorithmic and can take time. In the meantime, strengthen site trust signals: fresh content updates, technical hygiene, structured internal linking, and security hardening.
The bigger issue is that a subdomain compromise can bleed perceived site quality into the root domain, especially if they are closely associated. Recovery often happens gradually, not all at once. I would focus less on waiting and more on proving stability over the next crawl cycles.
