Created
September 1, 2026 12:47
-
-
Save silence-is-best/df9627fac2f23aaa0a17cd7ff3cb71f8 to your computer and use it in GitHub Desktop.
August Malspam Campaigns
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Date,Details,Email Payload Type,Users Targeted | |
| 8/3/2026,You have a new voicemail.; vbs -> screenconnect,Attachment,11 | |
| 8/4/2026,Project Inquiry: New Commercial Development; uue -> js -> originlogger,Attachment,7 | |
| 8/4/2026,Your Statement is ready; link -> exe -> screenconnect,Link,2 | |
| 8/4/2026,Zoom Meeting - EFT Settlement; link -> screenconnect,Link,132 | |
| 8/4/2026,Anthem Blue Cross EFT Settlement|Payment Approved on; link -> msi -> screenconnect,Link,129 | |
| 8/4/2026,NEW ORDER FROM EUROPE; gz -> js -> xloader,Attachment,2 | |
| 8/5/2026,Olvera SettIement Advlse; rar -> js -> xloader,Attachment,3 | |
| 8/5/2026,RV: ??: PO FOR AFLA Gmbh - Amendment PO# no. 2110_2110921-PO_ Updated; r00 -> donutloader -> originlogger,Attachment,3 | |
| 8/5/2026,Transfer Update|Electronic Funds Transfer; link -> screenconnect continued whole month,Link,15 | |
| 8/5/2026,Bid: Scope & Reimbursement; link -> screenconnect,Link,40 | |
| 8/5/2026,A2026_ORDER.gz; gz -> xloader,Attachment,2 | |
| 8/6/2026,Complemento de Pago; 001 -> xworm,Attachment,7 | |
| 8/6/2026,RE: Confirmaci�n de cuenta para esta transacci�n/ Banregio; arj -> js -> xworm,Attachment,3 | |
| 8/6/2026,Re: Re: New Quote Request; rar -> donutloader -> originlogger,Attachment,2 | |
| 8/7/2026,DOCUMENTO ESCANEADO; lzh -> js -> xworm,Attachment,7 | |
| 8/9/2026,URGENT REQUIREMENT! ( Ref : 10M-86776); rar -> js -> originlogger,Attachment,3 | |
| 8/10/2026,SOA_CD145074-Amana Ho_Booking with Ref. No. FT912Z / P10406 / MRG-10-08-26; r00 -> js -> originlogger,Attachment,3 | |
| 8/10/2026,New Message on Microsoft Teams Meeting; link -> screenconnect continuted to 8/24,Link,36 | |
| 8/11/2026,Completed: 2026 Social Security Statement is Now Available; link -> screenconnect,Link,43 | |
| 8/12/2026,CV Natalia Tarnowska; xlam -> hta -> xworm,Attachment,2 | |
| 8/12/2026,ACTION REQUIRED: 2026 Q2 SYSTEM UPDATE AND AUTHORIZATION; link -> screenconnect,Link,8 | |
| 8/12/2026,Invoice Follow-Up; link -> zip -> ninite,Link,24 | |
| 8/12/2026,Attachment name is Purchase_order.rar|RECONFIRM BANK DETAILS FOR PAYMENT; rar -> originlogger,Attachment,6 | |
| 8/12/2026,You've received a New Secured : Document Awaits Your Review & Signature; link -> screenconnect,Link,77 | |
| 8/12/2026,IMPORTANT:You have a new Update on your Charles Schwab|ACTION REQUIRED: 2026 Q2; link -> screenconnect,Link,7 | |
| 8/13/2026,Reg : SOA for Payments Made; zip -> js -> originlogger,Attachment,2 | |
| 8/13/2026,RECONFIRM BANK DETAILS FOR PAYMENT; rar -> js -> originlogger,Attachment,4 | |
| 8/13/2026,COMPRA 7121 - RE: COTIZACION; 001 -> darkcloud,Attachment,7 | |
| 8/16/2026,Inquiry (ACK2-02*500); vbs -> xloader,Attachment,4 | |
| 8/16/2026,Payment Advice - Advice Ref:[GLV410796721] / Priority payment / Customer Ref; rar -> js -> originlogger,Attachment,4 | |
| 8/16/2026,Notice: Contact Admin; link -> screenconnect,Link,32 | |
| 8/17/2026,Documents Pending Review (Signature Needed; Agreement Confirmation;- Action Alert; link -> screenconnect,Link,45 | |
| 8/17/2026,Your Tax Document(s) Is Available; link -> screenconnect,Link,33 | |
| 8/18/2026,Is this you???; zip -> link -> phorpiex continued to ,Attachment,41 | |
| 8/22/2026,New Purchase Order TMS-002498; zip ->js -> xloader,Attachment,2 | |
| 8/25/2026,RE:Order; rar -> js -> xloader,Attachment,2 | |
| 8/25/2026,Attachment name is wells fargo ach remittance copy.rar; rar -> js -> remcos,Attachment,9 | |
| 8/26/2026,solicitud de cotizaci�n; lha -> js -> xloader,Attachment,13 | |
| 8/27/2026,COMPROBANTE DE PAGO; arj -> js -> xloader,Attachment,10 | |
| 8/28/2026,Attachment name is QUOTATION - KATTY STEEL SUPPLY.rar; rar ->js -> remcos,Attachment,9 | |
| 8/28/2026,solicitud de cotizaci�n; bz|xz-> js -> xworm,Attachment,3 | |
| 8/31/2026,Processed INV; rar -> js -> remcos,Attachment,9 | |
| donutloader-originlogger, mail.commtechtrading.com | |
| donutloader-originlogger, ftp.melrz.com | |
| donutloader-originlogger, ftp.ulfl.co.in | |
| donutloader-phantomstealer, mail.trimnt.com | |
| donutloader-phantomstealer, mail.trimnt.com | |
| donutloader-phantomstealer, mail.trimnt.com | |
| donutloader-snakekeylogger, cphost17.qhoster.net | |
| donutloader-vipkeylogger, cphost17.qhoster.net | |
| donutloader-xloader, http://www.batesytransport.com/d0ra | |
| guloader-xloader, www.wanganuifirewood.co.nz | |
| masslogger, mail.trimnt.com | |
| masslogger, mail.trimnt.com | |
| masslogger, mail.trimnt.com | |
| masslogger, mail.trimnt.com | |
| medusahvnc, 51.89.204.28:4444 | |
| originlogger, ftp.altatsradgez.com | |
| originlogger, ftp.altatsradgez.com | |
| originlogger, ftp.piovau.com | |
| originlogger, ftp.vilimorin.com | |
| originlogger, ftp.altatsradgez.com | |
| originlogger, ftp.altatsradgez.com | |
| originlogger, ftp.altatsradgez.com | |
| originlogger, ftp.hhautoinvestment.co.tz | |
| originlogger, mail.onionmail.org | |
| originlogger, ftp.piovau.com | |
| originlogger, mail.onionmail.org | |
| originlogger, ftp.orangesac.com | |
| originlogger, ftp.raxclopent.info | |
| originlogger, server275.web-hosting.com | |
| originlogger, ftp.raxclopent.info | |
| originlogger, ftp.ltcresource.com.my | |
| originlogger, server275.web-hosting.com | |
| originlogger, ftp.piovau.com | |
| originlogger, server275.web-hosting.com | |
| originlogger, ftp.sanchezamador.com.mx | |
| phantomstealer, mail.sunrisereps.com | |
| phantomstealer, https://api.telegram.org/bot8916769568 | |
| phantomstealer, mail.trimnt.com | |
| phantomstealer, mail.samisud.it | |
| purelogsstealer, 2.27.62.123:4449 | |
| purelogsstealer, 2.27.62.123:4449 | |
| purerat, 104.249.10.71:2555 | |
| remcos, rem.herbalsupplementss.com:2404 | |
| remcos, kesmn.com:2404 | |
| remcos, 45.225.135.94:2404 | |
| remcos, 155.103.70.198:13408 | |
| remcos, 141.98.10.150:14641 | |
| remcos, 107.175.148.88:465 | |
| remcos, 141.98.10.150:14642 | |
| remcos, 141.98.10.150:14642 | |
| remcos, 155.103.70.198:13408 | |
| remcos, 155.103.70.198:13408 | |
| remcos, 141.98.10.150:14642 | |
| screenconnect, instance-jxog3a-relay.screenconnect.com | |
| screenconnect, 78.111.67.37:8041 | |
| screenconnect, instance-t7tffr-relay.screenconnect.com | |
| screenconnect, instance-l26mwr-relay.screenconnect.com | |
| screenconnect, instance-t7tffr-relay.screenconnect.com | |
| screenconnect, instance-jxog3a-relay.screenconnect.com | |
| screenconnect, instance-qmf2op-relay.screenconnect.com | |
| screenconnect, instance-kuow8m-relay.screenconnect.com | |
| screenconnect, instance-wpum04-relay.screenconnect.com | |
| screenconnect, instance-sp9qjy-relay.screenconnect.com | |
| screenconnect, instance-rgpzq7-relay.screenconnect.com | |
| screenconnect, relay.gamedbd.com:8041 | |
| screenconnect, servsepower.com:8041 | |
| screenconnect, instance-jxog3a-relay.screenconnect.com | |
| screenconnect, instance-accmjr-relay.screenconnect.com | |
| screenconnect, instance-qpac6d-relay.screenconnect.com | |
| screenconnect, instance-l26mwr-relay.screenconnect.com | |
| screenconnect, instance-alr2zy-relay.screenconnect.com | |
| screenconnect, instance-c2md8y-relay.screenconnect.com | |
| snakekeylogger, mail.exczx.com | |
| snakekeylogger, https://api.telegram.org/bot8238878826 | |
| stormkitty-xworm, 185.254.96.128:1605 | |
| xloader, www.grinswakebthu.info | |
| xloader, www.taibeinan.cc | |
| xloader, www.bestbooksusa.shop/t1bs | |
| xloader, http://www.grinswakebthu.info | |
| xloader, www.grinswakebthu.info | |
| xloader, www.titanium303.com/32hk | |
| xloader, www.sdkxx.cn | |
| xloader, http://www.batesytransport.com/d0ra | |
| xloader, http://www.paydaylaon.info | |
| xloader, http://www.entertainment-factory.com/ths6 | |
| xloader, www.poligraf76.ru | |
| xloader, www.poligraf76.ru | |
| xloader, http://www.grinswakebthu.info/irpw/ | |
| xloader, http://www.grinswakebthu.info/irpw/ | |
| xloader, www.grinswakebthu.info | |
| xloader, www.aivow.fr/p7uv | |
| xloader, www.30nama.store/hrto | |
| xloader, http://www.30nama.store | |
| xloader, www.grinswakebthu.info | |
| xloader, www.strappers.co.za | |
| xloader, http://www.gucciclean.com/1nb8/ | |
| xloader, www.1management.pro | |
| xloader, www.grinswakebthu.info | |
| xloader, www.mmcmedclinic.ru | |
| xloader, www.filippiboats.xyz/iw87 | |
| xloader, http://www.entertainment-factory.com/ths6 | |
| xloader, http://www.pildun26.site/ys2l/ | |
| xworm, 64.89.162.178:7007 | |
| xworm, 64.89.162.178:7007 | |
| xworm, petro4prime.ydns.eu:8793 | |
| xworm, carrenzaalwarex.ddns.net:7004 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 178.173.247.121:1982 | |
| xworm, carrenzaalwarex.ddns.net:7004 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 194.116.236.94:4433 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 64.89.162.178:7007 | |
| xworm, petro4prime.ydns.eu:8793 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 194.116.236.223:1717 | |
| xworm, 194.116.236.223:1717 | |
| xworm, carrenzaalwarex.ddns.net:7004 | |
| xworm, bucakosb.org.tr:7080 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 64.89.162.178:7007 | |
| xworm, 109.248.150.244:1070 | |
| xworm, jar5.ydns.eu:8793 | |
| ajibo@hhautoinvestment.co.tz, | |
| backupshinini@piovau.com, | |
| beautyv@ltcresource.com.my, | |
| bsinerjulygee1@raxclopent.info, | |
| cloudbackupbigger@piovau.com, | |
| doc@altatsradgez.com, | |
| EMTEE@vilimorin.com, | |
| fiajul.haq@commtechtrading.com, | |
| jodgoenpire@ibn-ltd.com, | |
| litexxxxxxxxxx@orangesac.com, | |
| method12@exczx.com, | |
| mez@altatsradgez.com, | |
| niceman@sanchezamador.com.mx, | |
| noreply@melrz.com, | |
| sendboxorigin@onionmail.org, | |
| serveradmin@ulfl.co.in, | |
| shabbir.ahmad@commtechtrading.com, | |
| snakesender@exzwzc.com, |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment