Article from September 2017
Hello Boys and Girls, its been some time since the last post and I thought I would give everyone that reads my ramblings a freebie. As you already know we look for interesting stuff and offer reporting for our customers. Many folks claim to be in the know and sell lots of services for astronomical prices, we figured it was time to show everyone why research makes sense and also releasing a small portion of some of the stuff we are working on. This is of course only possible with actual paying customers as contrary to believe and conception risk intelligence never was, isn’t and never will be a commodity (sorry to burst all your bubbles folks).
On to what this post is about….
Some of you folks may know the haveibeenpwnd site and the person operating it Troy Hunt. Why back when the site was not used to sell tickets to talks that Troy does it actually was not bad. In recent months though many in the security community have started to question the quality of data and the commercialness of this site. I will stay out of the conversation because I barely know Troy and I am certain he has no clue who I am (besides an 1D10T ;-).
Multiple reports have been circulating about a latest breach trove that Troy has “gotten his hands on exclusively”. We want to burst that bubble right here and now because we have a ton of stuff that we are currently going through and compared some items with his “exclusive” breach trove. Unfortunately we found many entries in AntiPublic 2017, Tessa and other groups combolists that we have had (in some cases) for at least 6 months now. I am not saying this to “bash” anyone but only want to correct some statements to make sure people understand a few things about combolists and breached data or data dumps. Many companies are now starting to offer these services and while we know a very few that are actually good, most of those services and websites are either not that good or down right bad (because they are made to steal PI information about the very people that are trying to validate their records. Other sites are using your information for spamming campaigns, phishing and marketing. Some of those emails are downright fear mongering to say the least and it makes my skin crawl…..
So lets talk a little bit about how data is released in different ways (both on darknet shops, forums and private sites just as they are in pastebin, ghostbin and many other services. More often than not, you will see data reposted multiple times by different groups claiming to be the ones that actually breached the site or company (we see a lot of this currently with Equifax BTW). Many folks who only skim the surface will not know how to verify or confirm the breaches are even legitimate (this takes experience and research and there are no short cuts here my friends). These lists go into millions and sometimes up to about 500 million (we have seen them recently as well tbh). Some folks will argue that all the lists are not relevant, only the initial ones are and we are somewhere in the middle of this. If we see new passwords we will post the accounts multiple times (think of this like a password history and attacking history record. So when we talk about our 4 billion accounts we are only talking about emails and some of those are involved in multiple (campaigns and attacks). We don’t sell this as a main feature of our subscriptions but only as a basic level of information to use for OSINT scans and possible attack vectors. Why? well because nation-states and other types of attackers WILL use this often. So the more you know about data that is “out there” or “out here” the better prepared you can be to just how much data is actually in someone else’s attack infrastructure. BTW you can not fully automate this process either (I know many big companies claim this but quite honestly thats just bullshit. There is always a certain amount of manual work to standardize any types of data so this is one of the many reasons this will never ever be a commodity (even with all that fancy schamncy AI people are trying to sell you right now.
SpamBots are one of those automated tools used to gather data and use that to “ping” or send anyone and everyone unsolicited emails of things you don’t need or want. This data is partially gained by the same combolists and data dumps we collect as well as breaching a company’s website or databases. Selling emails is a viable business both in the normal and darkness (believe me this is a grey zone and by no means hacking…). The treasure trove that Troy Hunt was alluding to is one of those SpamBots that was reverse engineered and the data dumped for various different folks to use.
Some of the attachments and details are below:
Some of the letters used in this spambot campaign are:
A worrying thing is the fact that multiple letters continue to evolve into really good looking and legitimate emails that many companies actually do send. Companies like DHL, UBS, UPS, BofA, eBay, Amazon, etc. This should get people thinking about how, where and when you release your datas into the internet.
We wanted to give you an idea of what type of data is currently in this latest released SpamBot files that are starting to circulate around various sites and dump services like pastebin (in one form or another).
├── accounts │ ├── 123123123123123123123.txt_1504010376.txt │ ├── accs_for_au_1497221760.txt │ ├── acc_test_1503266456.txt │ ├── acc_test2_1503275044.txt │ ├── all_bad_domain_1.txt_1491290162.txt │ ├── all_bad_domain_2.txt_1491290213.txt │ ├── all_bad_domain_3.txt_1491290271.txt │ ├── all_bad_domain_nashi.txt_1491289993.txt │ ├── all_full_bad.txt_1491289895.txt │ ├── all_smtp_1.txt_1491290392.txt │ ├── all_smtp_2.txt_1491290461.txt │ ├── all_smtp_3.txt_1491290525.txt │ ├── all_smtp.txt_1490959954.txt │ ├── auth_1004.txt │ ├── auth_good_full_good_1004.txt │ ├── f_1908_1503152352.txt │ ├── f_2008_1503224045.txt │ ├── f_2808_1503869009.txt │ ├── filessss_1492921017.txt │ ├── full_good_1004.txt │ ├── good_1004.txt │ ├── good_full_good_1004.txt │ ├── good_i_autoris_all.txt │ ├── inbox_chek_1503859859.txt │ ├── kr_fullgoodfromalexburnewcheck0404.txt │ ├── Mask_Max_1496419114.txt │ ├── no.txt_1494570842.txt │ ├── smtp_1708_1.txt_1502994260.txt │ ├── smtp_1808.txt_1503092191.txt │ ├── smtp_2108.txt_1503326784.txt │ ├── smtp_2208.txt_1503429512.txt │ ├── smtp_2408.txt_1503590639.txt │ ├── smtp_2508_1.txt_1503666206.txt │ ├── smtp_2508.txt_1503648730.txt │ ├── smtp_2608.txt_1503773195.txt │ ├── smtp_2808_1.txt_1503925334.txt │ ├── smtp_2808_2.txt_1503950860.txt │ ├── smtp_2908_1.txt_1504021910.txt │ ├── smtp_2908_2.txt_1504021939.txt │ ├── Smtp_fullgood_ALL.txt_1491289436.txt │ ├── Smtp_good_ALL.txt_1491289628.txt │ ├── Smtp_only_good_1.txt_1491289468.txt │ ├── Smtp_only_good_2.txt_1491289493.txt │ ├── Smtp_only_good_3.txt_1491289520.txt │ ├── Smtp_only_good_4.txt_1491289538.txt │ ├── Smtp_only_good_5.txt_1491289554.txt │ └── test_accs_1497241576.txt ├── attachments │ └── test_attach_links_1493637742.txt ├── backup │ ├── slivdump_one │ │ ├── americanfootballmonthly.secureorderingonline.com_lccommerce_gs_users.txt │ │ ├── americanfootballmonthly.secureorderingonline.com_lccommerce_orders.txt │ │ ├── biglotschina.com_biglotsc_biglotsc_customer.txt │ │ ├── cmw.net_db451990364_2016_cmbia_voters.txt │ │ ├── cmw.net_db451990364_cmbia_voters.txt │ │ ├── gurgaon.dronacharya.ac.in_dronaac_gurgaon_contact.txt │ │ ├── iloveread.in_booklfte_sendy_subscribers.txt │ │ ├── jderef.com_phpref_co_uk_user_contributions.txt │ │ ├── modhbrahminraj.org_milicense_demo_down.txt │ │ ├── news.linuxscada.info_agatigranat_customers.txt │ │ ├── news.linuxscada.info_fashionhall2_zakaz.txt │ │ ├── news.linuxscada.info_fashionhall_zakaz.txt │ │ ├── NOCHECK │ │ │ ├── americanfootballmonthly.secureorderingonline.com_lccommerce_gs_users.txtNOCHECK │ │ │ ├── americanfootballmonthly.secureorderingonline.com_lccommerce_orders.txtNOCHECK │ │ │ ├── biglotschina.com_biglotsc_biglotsc_customer.txtNOCHECK │ │ │ ├── cmw.net_db451990364_2016_cmbia_voters.txtNOCHECK │ │ │ ├── cmw.net_db451990364_cmbia_voters.txtNOCHECK │ │ │ ├── gurgaon.dronacharya.ac.in_dronaac_gurgaon_contact.txtNOCHECK │ │ │ ├── iloveread.in_booklfte_sendy_subscribers.txtNOCHECK │ │ │ ├── jderef.com_phpref_co_uk_user_contributions.txtNOCHECK │ │ │ ├── modhbrahminraj.org_milicense_demo_down.txtNOCHECK │ │ │ ├── news.linuxscada.info_agatigranat_customers.txtNOCHECK │ │ │ ├── news.linuxscada.info_fashionhall2_zakaz.txtNOCHECK │ │ │ ├── news.linuxscada.info_fashionhall_zakaz.txtNOCHECK │ │ │ ├── orchidtrays.com.au_orchi312_orchid_client_list.txtNOCHECK │ │ │ ├── preetlari.com_db622181465_Members.txtNOCHECK │ │ │ ├── result.bharatstudent.com_blogs_bsnewcontest.txtNOCHECK │ │ │ ├── result.bharatstudent.com_blogs_events.txtNOCHECK │ │ │ ├── result.bharatstudent.com_blogs_wcup_daily_poll_results.txtNOCHECK │ │ │ ├── savvyshopper.smartcanucks.ca_sc_blogosphere_evots_comment.txtNOCHECK │ │ │ ├── sevenmm.altervista.org_my_sevenmm_zen_comments.txtNOCHECK │ │ │ ├── touslesdeces.com_phpfoxfcanew_user.txtNOCHECK │ │ │ ├── touslesdeces.com_phpfoxgenealogie_user.txtNOCHECK │ │ │ ├── variabaru.com_chewcoid_vb_tblcustomer.txtNOCHECK │ │ │ ├── www.all-chips.com_allchips_tblCart.txtNOCHECK │ │ │ ├── www.alucasevents.com_emergencies_user.txtNOCHECK │ │ │ ├── www.americantiredepot.com_AmericanTireDepotDB_career_details.txtNOCHECK │ │ │ ├── www.americantiredepot.com_AmericanTireDepotDB_customer_mast.txtNOCHECK │ │ │ ├── www.americantiredepot.com_AmericanTireDepotDB_promo_redeem.txtNOCHECK │ │ │ ├── www.asiatravelestate.travel_asiatravelestate_reservation.txtNOCHECK │ │ │ ├── www.asiatravelestate.travel_touringasia_reservation.txtNOCHECK │ │ │ ├── www.asnbroker.co.th_wpasnbroker_contact_mail.txtNOCHECK │ │ │ ├── www.azea.fr_uretouc1_ups_data.txtNOCHECK │ │ │ ├── www.bestmaidproducts.com_bestmaidshop_ss_customers_two.txtNOCHECK │ │ │ ├── www.bluediamonds.co.uk_goldsovereigns_orders.txtNOCHECK │ │ │ ├── www.bumwoosa.co.kr_bumwoo_sp_orders.txtNOCHECK │ │ │ ├── www.bumwoosa.co.kr_bumwoo_tb_users.txtNOCHECK │ │ │ ├── www.capablanca.it_Sql143005_1_commenti.txtNOCHECK │ │ │ ├── www.cpafma.org_cpaadmin_forums_glowhostspamomatic_log.txtNOCHECK │ │ │ ├── www.dienstleistungen-24.net_camping_anzeigen_net_camping.txtNOCHECK │ │ │ ├── www.dienstleistungen-24.net_dienstleistungen_24_net_dienstleistungen.txtNOCHECK │ │ │ ├── www.dienstleistungen-24.net_ferien_center_com_feriencenter.txtNOCHECK │ │ │ ├── www.dienstleistungen-24.net_ferienzeiger_net_kleinanzeigen.txtNOCHECK │ │ │ ├── www.easylondonaccommodation.com_easylond_website_messages.txtNOCHECK │ │ │ ├── www.eden.pl_edencorpo_contact.txtNOCHECK │ │ │ ├── www.eden.pl_edenee_new_6_0_0_0_0.txtNOCHECK │ │ │ ├── www.eden.pl_edenfi_new_8_0.txtNOCHECK │ │ │ ├── www.eden.pl_edenfr_new_0515_5_6_0.txtNOCHECK │ │ │ ├── www.eden.pl_edenfr_new_5_6_0.txtNOCHECK │ │ │ ├── www.eden.pl_edenlt_new_8_0_0_0_0.txtNOCHECK │ │ │ ├── www.eden.pl_edenlu_new_5_6_0.txtNOCHECK │ │ │ ├── www.eden.pl_edennl_new_0508_6_0_0_0_0.txtNOCHECK │ │ │ ├── www.eden.pl_edennl_new_6_0_0_0_0.txtNOCHECK │ │ │ ├── www.eden.pl_edenuk_new_0_0.txtNOCHECK │ │ │ ├── www.eden.pl_edenuk_new_10_0.txtNOCHECK │ │ │ ├── www.eden.pl_wellbeingatwork_get_competition.txtNOCHECK │ │ │ ├── www.elala.in_seawinde_elala_download_anroid_front.txtNOCHECK │ │ │ ├── www.elala.in_seawinde_elala_users.txtNOCHECK │ │ │ ├── www.geologie.ac.at_km_mandant_kunden_20150729.txtNOCHECK │ │ │ ├── www.geologie.ac.at_km_mandant_kunden.txtNOCHECK │ │ │ ├── www.geologie.ac.at_km_mandant_shop_order_addresses.txtNOCHECK │ │ │ ├── www.haotaichem.com_chengzechem_xundan.txtNOCHECK │ │ │ ├── www.hofstragala.com_journals_prod_ej_attendee.txtNOCHECK │ │ │ ├── www.idson.com_agoudey_2882users.txtNOCHECK │ │ │ ├── www.idson.com_agoudey_links_newlink.txtNOCHECK │ │ │ ├── www.idson.com_agoudey_users.txtNOCHECK │ │ │ ├── www.lube.co.jp_chm1140002_japanese_member.txtNOCHECK │ │ │ ├── www.lube.co.jp_chm1140002_japanese_otoiawase.txtNOCHECK │ │ │ ├── www.lube.co.jp_chm1140002_jpbacup_member.txtNOCHECK │ │ │ ├── www.lube.co.jp_chm1140002_jpbacup_otoiawase.txtNOCHECK │ │ │ ├── www.lvbrideandgroom.com_drupalstore_users.txtNOCHECK │ │ │ ├── www.maralencherry.smcim.org_dioces_db_priests.txtNOCHECK │ │ │ ├── www.maralencherry.smcim.org_smcim_one_priest_email.txtNOCHECK │ │ │ ├── www.maralencherry.smcim.org_smcim_one_priests.txtNOCHECK │ │ │ ├── www.marcelbeekman.com_triosuleika_v2_posts.txtNOCHECK │ │ │ ├── www.menakacard.in_menakaca_emc_emc_enquires.txtNOCHECK │ │ │ ├── www.monolink.kr_monolink_sp_orders.txtNOCHECK │ │ │ ├── www.monolink.kr_monolink_tb_users.txtNOCHECK │ │ │ ├── www.nigerianafcsc.org_nigerian_afcscdb_testimony.txtNOCHECK │ │ │ ├── www.onegreenearth.com_kkeegan001_server_more.txtNOCHECK │ │ │ ├── www.profitadlinks.com_safelis8_profitad_members.txtNOCHECK │ │ │ ├── www.profitadlinks.com_safelis8_trafficad_members.txtNOCHECK │ │ │ ├── www.promonoleggi.com_fourltd_energieshop_newsletter_utenti.txtNOCHECK │ │ │ ├── www.promonoleggi.com_fourltd_invesco_newsletter_utenti.txtNOCHECK │ │ │ ├── www.renys.com_renysCMP_customers.txtNOCHECK │ │ │ ├── www.renys.com_renysCMP_users.txtNOCHECK │ │ │ ├── www.restaurantfurniture.biz_bshoberg_seating_rf_customer_info.txtNOCHECK │ │ │ ├── www.roskrup.ru_z59845_portal_linkator.txtNOCHECK │ │ │ ├── www.roskrup.ru_z59845_portal_oborudovanie_message.txtNOCHECK │ │ │ ├── www.roskrup.ru_z59845_portal_users.txtNOCHECK │ │ │ ├── www.spmaltd.org.uk_evolvenetmainsqlfour_darusalaamperfumes_mailinglist.txtNOCHECK │ │ │ ├── www.spmaltd.org.uk_evolvenetmainsqlfour_islamicdawah_mailinglist.txtNOCHECK │ │ │ ├── www.spmaltd.org.uk_evolvenetmainsqlfour_ukcertificates_personalinfo.txtNOCHECK │ │ │ ├── www.spmaltd.org.uk_evolvenetmainsqlfour_welljuice_mailinglist.txtNOCHECK │ │ │ ├── www.sugartech.co.za_sugarte_db1_updatersbackup2.txtNOCHECK │ │ │ ├── www.sugartech.co.za_sugarte_db1_updatersbackup.txtNOCHECK │ │ │ ├── www.sugartech.co.za_sugarte_db1_updaters.txtNOCHECK │ │ │ ├── www.swpark.or.th_joomla_jos_training_members.txtNOCHECK │ │ │ ├── www.swpark.or.th_joomla_jos_users.txtNOCHECK │ │ │ ├── www.thebrushbar.com_thebbcontentdb76_quickclass.txtNOCHECK │ │ │ ├── www.trinetsolutions.com_trinet_cc_emails.txtNOCHECK │ │ │ ├── www.trinetsolutions.com_trinet_devdb_client_projects_snapshots.txtNOCHECK │ │ │ ├── www.trinetsolutions.com_trinet_devdb_client_projects.txtNOCHECK │ │ │ ├── www.twfoam.co.uk_twfoam_co_uk_Customers.txtNOCHECK │ │ │ ├── www.ukrainianjournal.com_uajournal_db_users.txtNOCHECK │ │ │ ├── www.westcoastpromobabes.com.au_wcpb_db_blog_comments.txtNOCHECK │ │ │ ├── www.x86-secret.com_xsecret_users.txtNOCHECK │ │ │ ├── www.xn--w39at8yiycnv4a.kr_pochan_sp_orders.txtNOCHECK │ │ │ └── www.xn--w39at8yiycnv4a.kr_pochan_tb_users.txtNOCHECK │ │ ├── orchidtrays.com.au_orchi312_orchid_client_list.txt │ │ ├── preetlari.com_db622181465_Members.txt │ │ ├── result.bharatstudent.com_blogs_bsnewcontest.txt │ │ ├── result.bharatstudent.com_blogs_events.txt │ │ ├── result.bharatstudent.com_blogs_wcup_daily_poll_results.txt │ │ ├── savvyshopper.smartcanucks.ca_sc_blogosphere_evots_comment.txt │ │ ├── sevenmm.altervista.org_my_sevenmm_zen_comments.txt │ │ ├── touslesdeces.com_phpfoxfcanew_user.txt │ │ ├── touslesdeces.com_phpfoxgenealogie_user.txt │ │ ├── variabaru.com_chewcoid_vb_tblcustomer.txt │ │ ├── www.all-chips.com_allchips_tblCart.txt │ │ ├── www.alucasevents.com_emergencies_user.txt │ │ ├── www.americantiredepot.com_AmericanTireDepotDB_career_details.txt │ │ ├── www.americantiredepot.com_AmericanTireDepotDB_customer_mast.txt │ │ ├── www.americantiredepot.com_AmericanTireDepotDB_promo_redeem.txt │ │ ├── www.asiatravelestate.travel_asiatravelestate_reservation.txt │ │ ├── www.asiatravelestate.travel_touringasia_reservation.txt │ │ ├── www.asnbroker.co.th_wpasnbroker_contact_mail.txt │ │ ├── www.azea.fr_uretouc1_ups_data.txt │ │ ├── www.bestmaidproducts.com_bestmaidshop_ss_customers_two.txt │ │ ├── www.bluediamonds.co.uk_goldsovereigns_orders.txt │ │ ├── www.bumwoosa.co.kr_bumwoo_sp_orders.txt │ │ ├── www.bumwoosa.co.kr_bumwoo_tb_users.txt │ │ ├── www.capablanca.it_Sql143005_1_commenti.txt │ │ ├── www.cpafma.org_cpaadmin_forums_glowhostspamomatic_log.txt │ │ ├── www.dienstleistungen-24.net_camping_anzeigen_net_camping.txt │ │ ├── www.dienstleistungen-24.net_dienstleistungen_24_net_dienstleistungen.txt │ │ ├── www.dienstleistungen-24.net_ferien_center_com_feriencenter.txt │ │ ├── www.dienstleistungen-24.net_ferienzeiger_net_kleinanzeigen.txt │ │ ├── www.easylondonaccommodation.com_easylond_website_messages.txt │ │ ├── www.eden.pl_edencorpo_contact.txt │ │ ├── www.eden.pl_edenee_new_6_0_0_0_0.txt │ │ ├── www.eden.pl_edenfi_new_8_0.txt │ │ ├── www.eden.pl_edenfr_new_0515_5_6_0.txt │ │ ├── www.eden.pl_edenfr_new_5_6_0.txt │ │ ├── www.eden.pl_edenlt_new_8_0_0_0_0.txt │ │ ├── www.eden.pl_edenlu_new_5_6_0.txt │ │ ├── www.eden.pl_edennl_new_0508_6_0_0_0_0.txt │ │ ├── www.eden.pl_edennl_new_6_0_0_0_0.txt │ │ ├── www.eden.pl_edenuk_new_0_0.txt │ │ ├── www.eden.pl_edenuk_new_10_0.txt │ │ ├── www.eden.pl_wellbeingatwork_get_competition.txt │ │ ├── www.elala.in_seawinde_elala_download_anroid_front.txt │ │ ├── www.elala.in_seawinde_elala_users.txt │ │ ├── www.geologie.ac.at_km_mandant_kunden_20150729.txt │ │ ├── www.geologie.ac.at_km_mandant_kunden.txt │ │ ├── www.geologie.ac.at_km_mandant_shop_order_addresses.txt │ │ ├── www.haotaichem.com_chengzechem_xundan.txt │ │ ├── www.hofstragala.com_journals_prod_ej_attendee.txt │ │ ├── www.idson.com_agoudey_2882users.txt │ │ ├── www.idson.com_agoudey_links_newlink.txt │ │ ├── www.idson.com_agoudey_users.txt │ │ ├── www.lube.co.jp_chm1140002_japanese_member.txt │ │ ├── www.lube.co.jp_chm1140002_japanese_otoiawase.txt │ │ ├── www.lube.co.jp_chm1140002_jpbacup_member.txt │ │ ├── www.lube.co.jp_chm1140002_jpbacup_otoiawase.txt │ │ ├── www.lvbrideandgroom.com_drupalstore_users.txt │ │ ├── www.maralencherry.smcim.org_dioces_db_priests.txt │ │ ├── www.maralencherry.smcim.org_smcim_one_priest_email.txt │ │ ├── www.maralencherry.smcim.org_smcim_one_priests.txt │ │ ├── www.marcelbeekman.com_triosuleika_v2_posts.txt │ │ ├── www.menakacard.in_menakaca_emc_emc_enquires.txt │ │ ├── www.monolink.kr_monolink_sp_orders.txt │ │ ├── www.monolink.kr_monolink_tb_users.txt │ │ ├── www.nigerianafcsc.org_nigerian_afcscdb_testimony.txt │ │ ├── www.onegreenearth.com_kkeegan001_server_more.txt │ │ ├── www.profitadlinks.com_safelis8_profitad_members.txt │ │ ├── www.profitadlinks.com_safelis8_trafficad_members.txt │ │ ├── www.promonoleggi.com_fourltd_energieshop_newsletter_utenti.txt │ │ ├── www.promonoleggi.com_fourltd_invesco_newsletter_utenti.txt │ │ ├── www.renys.com_renysCMP_customers.txt │ │ ├── www.renys.com_renysCMP_users.txt │ │ ├── www.restaurantfurniture.biz_bshoberg_seating_rf_customer_info.txt │ │ ├── www.roskrup.ru_z59845_portal_linkator.txt │ │ ├── www.roskrup.ru_z59845_portal_oborudovanie_message.txt │ │ ├── www.roskrup.ru_z59845_portal_users.txt │ │ ├── www.spmaltd.org.uk_evolvenetmainsqlfour_darusalaamperfumes_mailinglist.txt │ │ ├── www.spmaltd.org.uk_evolvenetmainsqlfour_islamicdawah_mailinglist.txt │ │ ├── www.spmaltd.org.uk_evolvenetmainsqlfour_ukcertificates_personalinfo.txt │ │ ├── www.spmaltd.org.uk_evolvenetmainsqlfour_welljuice_mailinglist.txt │ │ ├── www.sugartech.co.za_sugarte_db1_updatersbackup2.txt │ │ ├── www.sugartech.co.za_sugarte_db1_updatersbackup.txt │ │ ├── www.sugartech.co.za_sugarte_db1_updaters.txt │ │ ├── www.swpark.or.th_joomla_jos_training_members.txt │ │ ├── www.swpark.or.th_joomla_jos_users.txt │ │ ├── www.thebrushbar.com_thebbcontentdb76_quickclass.txt │ │ ├── www.trinetsolutions.com_trinet_cc_emails.txt │ │ ├── www.trinetsolutions.com_trinet_devdb_client_projects_snapshots.txt │ │ ├── www.trinetsolutions.com_trinet_devdb_client_projects.txt │ │ ├── www.twfoam.co.uk_twfoam_co_uk_Customers.txt │ │ ├── www.ukrainianjournal.com_uajournal_db_users.txt │ │ ├── www.westcoastpromobabes.com.au_wcpb_db_blog_comments.txt │ │ ├── www.x86-secret.com_xsecret_users.txt │ │ ├── www.xn--w39at8yiycnv4a.kr_pochan_sp_orders.txt │ │ └── www.xn--w39at8yiycnv4a.kr_pochan_tb_users.txt │ ├── slivdump_one1 │ │ ├── NOCHECK │ │ │ ├── redlara.com_redlara_bd_cadastro_compl.txtNOCHECK │ │ │ ├── redlara.com_redlara_bd_cadastro.txtNOCHECK │ │ │ ├── redlara.com_redlara_bd_contato.txtNOCHECK │ │ │ └── redlara.com_redlara_bd_email.txtNOCHECK │ │ ├── redlara.com_redlara_bd_cadastro_compl.txt │ │ ├── redlara.com_redlara_bd_cadastro.txt │ │ ├── redlara.com_redlara_bd_contato.txt │ │ └── redlara.com_redlara_bd_email.txt │ ├── slivdump_one2 │ │ ├── bands.goanddomichigan.com_jrc_bestofdelcoresults.txt │ │ ├── bands.goanddomichigan.com_jrc_bestofmontcoresults_15.txt │ │ ├── bands.goanddomichigan.com_jrc_bestofmontcoresults.txt │ │ ├── bands.goanddomichigan.com_jrc_dnntalkofthetownresults_15.txt │ │ ├── bands.goanddomichigan.com_jrc_dnntalkofthetownresults.txt │ │ ├── napoli.com_interventi_commenti.txt │ │ ├── NOCHECK │ │ │ ├── bands.goanddomichigan.com_jrc_bestofdelcoresults.txtNOCHECK │ │ │ ├── bands.goanddomichigan.com_jrc_bestofmontcoresults_15.txtNOCHECK │ │ │ ├── bands.goanddomichigan.com_jrc_bestofmontcoresults.txtNOCHECK │ │ │ ├── bands.goanddomichigan.com_jrc_dnntalkofthetownresults_15.txtNOCHECK │ │ │ ├── bands.goanddomichigan.com_jrc_dnntalkofthetownresults.txtNOCHECK │ │ │ ├── napoli.com_interventi_commenti.txtNOCHECK │ │ │ ├── proway.com.br_proway__cliente.txtNOCHECK │ │ │ ├── proway.com.br_proway__contato_form.txtNOCHECK │ │ │ └── proway.com.br_proway__newsletter.txtNOCHECK │ │ ├── proway.com.br_proway__cliente.txt │ │ ├── proway.com.br_proway__contato_form.txt │ │ └── proway.com.br_proway__newsletter.txt │ ├── slivpass2 │ │ ├── bolsaphp.sukiweb.net.txt │ │ ├── iloveread.in.txt │ │ ├── moustachemay.com.txt │ │ ├── preetlari.com.txt │ │ ├── savvyshopper.smartcanucks.ca.txt │ │ ├── touslesdeces.com.txt │ │ ├── woodwind.ad-bazaar.com.txt │ │ ├── www.alucasevents.com.txt │ │ ├── www.bumwoosa.co.kr.txt │ │ ├── www.comeon-book.com.txt │ │ ├── www.crimestatssa.com.txt │ │ ├── www.jumbouk.com.txt │ │ ├── www.reading-badminton.org.uk.txt │ │ ├── www.roskrup.ru.txt │ │ ├── www.ukrainianjournal.com.txt │ │ └── www.x86-secret.com.txt │ ├── slivpass_save │ │ ├── americanfootballmonthly.secureorderingonline.com.txt │ │ ├── cartelera.uruguaytotal.com.txt │ │ ├── cmw.net.txt │ │ ├── iloveread.in.txt │ │ ├── indianpharma.in.txt │ │ ├── mega-ace.com.txt │ │ ├── moustachemay.com.txt │ │ ├── preetlari.com.txt │ │ ├── savvyshopper.smartcanucks.ca.txt │ │ ├── touslesdeces.com.txt │ │ ├── woodwind.ad-bazaar.com.txt │ │ ├── www.alucasevents.com.txt │ │ ├── www.asiatravelestate.travel.txt │ │ ├── www.bestmaidproducts.com.txt │ │ ├── www.bluediamonds.co.uk.txt │ │ ├── www.bumwoosa.co.kr.txt │ │ ├── www.cliqnship.com.txt │ │ ├── www.comeon-book.com.txt │ │ ├── www.crimestatssa.com.txt │ │ ├── www.dienstleistungen-24.net.txt │ │ ├── www.drvolomdental.hu.txt │ │ ├── www.easylondonaccommodation.com.txt │ │ ├── www.elala.in.txt │ │ ├── www.fantiniusa.com.txt │ │ ├── www.geologie.ac.at.txt │ │ ├── www.hofstragala.com.txt │ │ ├── www.idson.com.txt │ │ ├── www.jumbouk.com.txt │ │ ├── www.kosi.com.txt │ │ ├── www.lvbrideandgroom.com.txt │ │ ├── www.maralencherry.smcim.org.txt │ │ ├── www.monolink.kr.txt │ │ ├── www.onegreenearth.com.txt │ │ ├── www.pakistanintelligence.com.txt │ │ ├── www.reading-badminton.org.uk.txt │ │ ├── www.renys.com.txt │ │ ├── www.roskrup.ru.txt │ │ ├── www.sport.tu-dortmund.de.txt │ │ ├── www.stribro.cz.txt │ │ ├── www.swpark.or.th.txt │ │ ├── www.twfoam.co.uk.txt │ │ ├── www.ukrainianjournal.com.txt │ │ ├── www.vsro.de.txt │ │ ├── www.x86-secret.com.txt │ │ └── www.xn--w39at8yiycnv4a.kr.txt │ ├── slivpass_save1 │ │ ├── it.peacereporter.net.txt │ │ └── redlara.com.txt │ ├── slivpass_save2 │ │ └── bolsaphp.sukiweb.net.txt │ ├── sliv_save │ │ ├── album.hse.ru.txt │ │ ├── americanfootballmonthly.secureorderingonline.com.txt │ │ ├── biglotschina.com.txt │ │ ├── cartelera.uruguaytotal.com.txt │ │ ├── cmw.net.txt │ │ ├── gpsc.goa.gov.in.txt │ │ ├── gurgaon.dronacharya.ac.in.txt │ │ ├── iloveread.in.txt │ │ ├── indianpharma.in.txt │ │ ├── jderef.com.txt │ │ ├── lusterelite.com.txt │ │ ├── modhbrahminraj.org.txt │ │ ├── moustachemay.com.txt │ │ ├── mycompaniesact.com.txt │ │ ├── newland-id.com.tw.txt │ │ ├── news.linuxscada.info.txt │ │ ├── orchidtrays.com.au.txt │ │ ├── result.bharatstudent.com.txt │ │ ├── savvyshopper.smartcanucks.ca.txt │ │ ├── sevenmm.altervista.org.txt │ │ ├── smef.org.bd.txt │ │ ├── touslesdeces.com.txt │ │ ├── variabaru.com.txt │ │ ├── woodwind.ad-bazaar.com.txt │ │ ├── www.all-chips.com.txt │ │ ├── www.americantiredepot.com.txt │ │ ├── www.arizona-businessdirectory.com.txt │ │ ├── www.arvsolutions.co.uk.txt │ │ ├── www.asnbroker.co.th.txt │ │ ├── www.aspecialgift.com.txt │ │ ├── www.azea.fr.txt │ │ ├── www.bestmaidproducts.com.txt │ │ ├── www.bostonforrent.com.txt │ │ ├── www.bumwoosa.co.kr.txt │ │ ├── www.bvkb.be.txt │ │ ├── www.bzeebee.com.txt │ │ ├── www.capablanca.it.txt │ │ ├── www.cliqnship.com.txt │ │ ├── www.club-85.co.uk.txt │ │ ├── www.completemedical.com.txt │ │ ├── www.cpafma.org.txt │ │ ├── www.crimestatssa.com.txt │ │ ├── www.dienstleistungen-24.net.txt │ │ ├── www.easylondonaccommodation.com.txt │ │ ├── www.economynext.com.txt │ │ ├── www.eden.pl.txt │ │ ├── www.elala.in.txt │ │ ├── www.ffbasketcamps.com.txt │ │ ├── www.geologie.ac.at.txt │ │ ├── www.gipp.ru.txt │ │ ├── www.gnnusa.com.txt │ │ ├── www.habitathome.it.txt │ │ ├── www.haotaichem.com.txt │ │ ├── www.hofstragala.com.txt │ │ ├── www.hurktoilet.nl.txt │ │ ├── www.idson.com.txt │ │ ├── www.kosi.com.txt │ │ ├── www.kosmasaudiovideo.gr.txt │ │ ├── www.lube.co.jp.txt │ │ ├── www.lulu-en-furie.be.txt │ │ ├── www.lvbrideandgroom.com.txt │ │ ├── www.mafscooters.com.txt │ │ ├── www.maralencherry.smcim.org.txt │ │ ├── www.marcelbeekman.com.txt │ │ ├── www.menakacard.in.txt │ │ ├── www.monolink.kr.txt │ │ ├── www.motointer.com.txt │ │ ├── www.nexa.re.txt │ │ ├── www.nigerianafcsc.org.txt │ │ ├── www.onegreenearth.com.txt │ │ ├── www.pakistanintelligence.com.txt │ │ ├── www.ppdlawoffice.com.txt │ │ ├── www.profitadlinks.com.txt │ │ ├── www.promonoleggi.com.txt │ │ ├── www.renys.com.txt │ │ ├── www.restaurantfurniture.biz.txt │ │ ├── www.robinsonsflorists.biz.txt │ │ ├── www.roomersgifts.co.uk.txt │ │ ├── www.roskrup.ru.txt │ │ ├── www.spmaltd.org.uk.txt │ │ ├── www.sport.tu-dortmund.de.txt │ │ ├── www.sugartech.co.za.txt │ │ ├── www.swizzleinn.com.txt │ │ ├── www.swpark.or.th.txt │ │ ├── www.tacocasatexas.com.txt │ │ ├── www.texas-businessdirectory.com.txt │ │ ├── www.theatreinchicago.com.txt │ │ ├── www.thebrushbar.com.txt │ │ ├── www.thinkasiainvestthailand.com.txt │ │ ├── www.travelagentsofindia.com.txt │ │ ├── www.trinetsolutions.com.txt │ │ ├── www.veggies24x7.com.txt │ │ ├── www.vsro.de.txt │ │ ├── www.westcoastpromobabes.com.au.txt │ │ ├── www.wowaswann.eu.txt │ │ └── www.xn--w39at8yiycnv4a.kr.txt │ ├── sliv_save1 │ │ ├── bands.goanddomichigan.com.txt │ │ ├── it.peacereporter.net.txt │ │ ├── redlara.com.txt │ │ └── supertry.com.txt │ └── sliv_save2 │ ├── bands.goanddomichigan.com.txt │ ├── gourmandises.site.txt │ ├── it.flarus.ru.txt │ ├── napoli.com.txt │ ├── proway.com.br.txt │ ├── swapzaar.com.txt │ └── trasmecam.it.txt ├── bad │ ├── 4caroption_eng_no_bounce.txt.clear.txt │ ├── bank_2_no_bounce_0908.txt │ ├── bank_of_america_no_bounce_0908.txt │ ├── clear │ │ ├── 1china │ │ │ ├── domain.pl │ │ │ └── us_with_data_Valid_no_bounce_0908.txt │ │ ├── 2domain │ │ │ ├── emailsplit.pl │ │ │ ├── ex_d.pl │ │ │ └── stoplist.txt │ │ ├── 3abuse │ │ │ ├── ex_d.pl │ │ │ ├── ex_n.pl │ │ │ ├── stoplistD.txt │ │ │ └── stoplist.txt │ │ ├── 4verify │ │ │ ├── base.txt │ │ │ ├── base.txt.bad │ │ │ ├── base.txt.good │ │ │ └── vrfy.pl │ │ ├── 5answer │ │ │ ├── answered_d.txt │ │ │ ├── answered.txt │ │ │ ├── bounce.txt │ │ │ └── excl.pl │ │ └── USA_Sunny_no_bounce_0908.txt_noname │ ├── smtp │ │ ├── 1803_fullgood.txt_1489825426.txt │ │ ├── 1_good_1489739759.txt │ │ ├── 1.txt │ │ ├── 2.txt │ │ ├── 3.txt │ │ ├── 4.txt │ │ ├── 5.txt │ │ ├── 6.txt │ │ ├── 7.txt │ │ ├── 8.txt │ │ ├── acc_full_1493252209.txt │ │ ├── accss_1493041678.txt │ │ ├── amer_smtp_ne_trogat_1498633401.txt │ │ ├── au2_base_1493352083.txt │ │ ├── au_accs_1493262578.txt │ │ ├── excl.pl │ │ ├── fullgood_all.txt_1499252673.txt │ │ ├── Good_2.txt_1489624083.txt │ │ ├── good_i_autoris_all_1.txt │ │ ├── good_i_autoris_all.txt │ │ ├── result1.txt │ │ ├── result2.txt │ │ ├── smtp1.txt │ │ ├── smtp2.txt │ │ └── smtp_all_0707.txt │ ├── split │ ├── USA_85_million_email_new_part2_Valid_big.txt.clear.txt │ ├── USA_85_million_email_new_part2_Valid_corp_no_bounce_0908.txt │ ├── USA_Sunny_no_bounce_0908.txt │ └── us_with_data_Valid_no_bounce_0908.txt ├── base │ ├── 19_k_base_sun.txt_1497379746.txt │ ├── 1_de_job.txt │ ├── 200k_it.txt │ ├── 2kk_nlbaza_Valid.txt │ ├── alica.it.tin.it.tim.it.txt │ ├── AU_500k_to_Online.txt_1496953520.txt │ ├── AU_ALL.txt │ ├── au_base_all.txt │ ├── AU_NEW.txt │ ├── au_resend_1499126790.txt │ ├── bakaca_it.txt │ ├── bank_2_a24.txt │ ├── bank_of_america_a24.txt │ ├── base_es_1407.txt │ ├── base_football_soccer.txt_1499359612.txt │ ├── base_name_avangate1.txt │ ├── base_no_name_avangate1.txt │ ├── base_po_domain_mailinbox_3kk.txt │ ├── Clear_mailing_list.txt_J_ALL_sunny_1.txt │ ├── corp_1503273765.txt │ ├── desk_test_1496707669.txt │ ├── Email_freenet.de_487k.txt │ ├── email_only.txt │ ├── email_test_1503266500.txt │ ├── fastwebnet_it.txt │ ├── fling.com_40M_users_Valid.txt │ ├── fling.com_Valid.txt │ ├── friendsearch.com_Valid.txt │ ├── glock_1499557908.txt │ ├── gmail_linda_name_test.txt_1499093352.txt │ ├── gmail_test_1500908833.txt │ ├── gmail_test_cristifor.txt_1499783725.txt │ ├── gmail_test.txt_1492816240.txt │ ├── hotmail_it.txt │ ├── hotmail_test_1493993765.txt │ ├── hotmail_test_1496577181.txt │ ├── inbox_chek_1503859134.txt │ ├── IT_1.2kk_no_bounced.txt │ ├── italy_Valid.txt │ ├── Italy_with_names_Valid.txt │ ├── it_Valid.txt │ ├── IT_with_names_Valid.txt │ ├── jp2_Valid.txt │ ├── jp_Valid.txt │ ├── libero_it.txt │ ├── Mailer_Temp.txt │ ├── mailing_list_17mln_CL_bw_4_bw_1_a22.txt │ ├── mailing_list_17mln_CL_bw_4_bw_2_a22.txt │ ├── mailing_list_17mln_CL_bw_4_bw_3_a22.txt │ ├── mailing_list_17mln_CL_bw_4_bw_4_a22.txt │ ├── mailing_list_17mln_CL_bw_4_bw_5_a22.txt │ ├── mailing_list_2mln_bw_CL2.txt │ ├── MIX_128k_opened.txt │ ├── mix_fight_it.txt │ ├── muslimmatch.com_Valid.txt │ ├── new_smtp.txt │ ├── no_big_no_MX │ │ ├── +fling.com_40M_users.txt │ │ ├── +mate1.com-plain-november-2015.txt │ │ ├── +mix_fight_4_6kk_clean.txt │ │ ├── pixmania_data2_clean.txt │ │ ├── pixmania_data3_clean.txt │ │ ├── +sib_13.04.2016_files.txt │ │ ├── +sib16112016.txt │ │ ├── +sib_26.01.2017.txt │ │ ├── +SIB.txt │ │ └── Sites_000webhost.com.txt │ ├── old_Valid_Valid.txt │ ├── onlinehome.de_61k.txt │ ├── original │ │ ├── 1_de_job.txt │ │ ├── all_mix_de_5.7kk.txt │ │ ├── arcor.de_138k.txt │ │ ├── ch.txt_1493100945.txt │ │ ├── company_it_5k.txt │ │ ├── de_5kk.txt │ │ ├── Email_aol_7.3kk.txt │ │ ├── Email_eng_us.txt │ │ ├── Email_fastwebnet_it_test.txt │ │ ├── Email_freenet.de_487k.txt │ │ ├── Email_gmail.com_usa.txt │ │ ├── Email_gmx_de_test.txt │ │ ├── Email_hotmail.com_usa.txt │ │ ├── Email_hotmail.de_1.3kk.txt │ │ ├── Email_hotmail_it_test.txt_1493983275.txt │ │ ├── Email_info.de_1.2kk.txt │ │ ├── email_libero_test.txt_1492164063.txt │ │ ├── Email_mix_usa.txt │ │ ├── Email_tiscali_it_test.txt │ │ ├── Email_virgilio_it_test.txt │ │ ├── Email_web.de_3.6kk.txt │ │ ├── Email_yahoo.com_usa.txt │ │ ├── Email_yahoo_de_1.1kk.txt │ │ ├── Email_yahoo_it_test.txt_1493980076.txt │ │ ├── fastwebnet_it_1.6kk.txt │ │ ├── gmail.de_189k.txt │ │ ├── gmx.de_4.3kk.txt │ │ ├── hotmail_it_2.4kk.txt │ │ ├── info_279k.txt_1494645930.txt │ │ ├── libero_it_2.5kk.txt │ │ ├── mix_fight_it_4.6kk.txt │ │ ├── not_big_us.txt │ │ ├── online.de_214k.txt │ │ ├── onlinehome.de_61k.txt │ │ ├── tiscali_1_2kk.txt │ │ ├── t-online.de_1.9kk.txt │ │ ├── trash_US_Names_good.txt │ │ ├── us_big.txt │ │ ├── us_friendsearch.com.txt │ │ ├── US_Names_unknown.txt │ │ ├── us.txt │ │ ├── virgilio_it_1.6kk.txt │ │ ├── wp_users.txt │ │ └── yahoo_it_1.1kk.txt │ ├── out2.uk.txt │ ├── Output_Packer.txt_1504051095.txt │ ├── Output_Packer.txt_1504053359.txt │ ├── pixmania_data3_clean.txt │ ├── r_Valid.txt │ ├── sib_13.04.2016_files_Valid.txt │ ├── sib16112016_Valid.txt │ ├── sib_26.01.2017_Valid.txt │ ├── SIB-slivpass_save_1_Valid_badbase.txt │ ├── SIB-slivpass_save_1_Valid.txt │ ├── SIB-slivpass_save_2_Valid.txt │ ├── SIB-slivpass_save_3_Valid.txt │ ├── SIB-slivpass_save_4_Valid.txt │ ├── SIB-slivpass_save_5_Valid.txt │ ├── SSIB_Valid.txt │ ├── test_base_mail_1493638168.txt │ ├── test_base_mail_info_1493638369.txt │ ├── test_email_cristofor_400.txt_1503412439.txt │ ├── test_email_libero2_1493577732.txt │ ├── test_gmail_franco.txt_1498598048.txt │ ├── TEST_INBOX_.txt_1504010461.txt │ ├── TEST_INBOX_.txt_1504012395.txt │ ├── test_jp_1496725398.txt │ ├── test_mail_desk.txt_1491001373.txt │ ├── test_support5.txt_1498629714.txt │ ├── tiscali_it.txt │ ├── u1.txt │ ├── uk_au_Valid.txt │ ├── US_570k_no_bounced.txt │ ├── USA_85_million_email_new_part2_Valid_a24.txt │ ├── USA_85_million_email_new_part2_Valid_big_a24.txt │ ├── usa_base_work_25k.txt_1499092501.txt │ ├── usa_Valid.txt │ ├── US_names_Valid.txt │ ├── US_NaughtyAmerica_Valid.txt │ ├── US_not_big_clean_domain_Valid.txt │ ├── us_with_data_Valid_a24.txt │ ├── Valid │ │ ├── 2kk_nlbaza_Valid.txt │ │ ├── AdultFriendFinder_Valid.txt │ │ ├── aminno_member_email.dump_Valid.txt │ │ ├── aternos.org_Valid.txt │ │ ├── +Austrailia2008100k_Valid.txt │ │ ├── Austrailia2008100k_Valid.txt │ │ ├── Brazzers.com_Valid.txt │ │ ├── DacGroup.com_bCrypt_188k_April_2016_Valid.txt │ │ ├── dacgroup.com_users_6-3-2016_Valid.txt │ │ ├── diet.com_Valid.txt │ │ ├── DLH.net_1_Valid.txt │ │ ├── +fling.com_40M_users_Valid.txt │ │ ├── fling.com_Valid.txt │ │ ├── gamigo_Valid.txt │ │ ├── HeroesOfGaia.com_3.1m_2015-03-15_Valid.txt │ │ ├── Italy_with_names_Valid.txt │ │ ├── it_w_data_Valid.txt │ │ ├── JOB-Italy_Valid.txt │ │ ├── JOB-USA_Valid.txt │ │ ├── Leet.cc_Valid.txt │ │ ├── +mate1.com-plain-november-2015_Valid.txt │ │ ├── mate1_Valid.txt │ │ ├── +mix_fight_4_6kk_clean_Valid.txt │ │ ├── muslimmatch.com_Valid.txt │ │ ├── NaughtyAmerica_Valid.txt │ │ ├── +netia.pl_Valid.txt │ │ ├── Nihonomaru_Valid.txt │ │ ├── pixmania_data2_clean_Valid.txt │ │ ├── pixmania_data3_clean_Valid.txt │ │ ├── pixmania_data_clean_Valid.txt │ │ ├── Qatar_qnb_Valid.txt │ │ ├── +sib_13.04.2016_files_Valid.txt │ │ ├── +sib16112016_Valid.txt │ │ ├── +sib_26.01.2017_Valid.txt │ │ ├── SIB-slivpass_save_1_Valid.txt │ │ ├── SIB-slivpass_save_2_Valid.txt │ │ ├── SIB-slivpass_save_3_Valid.txt │ │ ├── SIB-slivpass_save_4_Valid.txt │ │ ├── SIB-slivpass_save_5_Valid.txt │ │ ├── +SIB_Valid.txt │ │ ├── Sites_000webhost.com_Valid.txt │ │ ├── suppres_email_list_Valid.txt │ │ ├── taobao.com_Valid.txt │ │ ├── uk_au_Valid.txt │ │ ├── USA_85_million_email_new_part_1_Valid.txt │ │ ├── USA_85_million_email_new_part2_Valid.txt │ │ ├── us_names_Valid.txt │ │ ├── US_not_big_clean_domain_Valid.txt │ │ ├── us_with_data_Valid.txt │ │ ├── uTorrent.com_Forums_2016-01-14_Valid.txt │ │ ├── wtspy-Accounts_Valid.txt │ │ └── +YouPorn_Valid.txt │ ├── virgilio_it.txt │ ├── yahoo_it.txt │ ├── yahoo_test_1499550672.txt │ └── yahoo_test.txt_1492699093.txt ├── from │ ├── 1_amazon_from.txt_1490958717.txt │ ├── 1_interesed.txt_1492901317.txt │ ├── 2_amazon_from.txt_1490959037.txt │ ├── 3_test_iphone_1495174114.txt │ ├── 4caroption_eBay_eng_from.txt_1499618480.txt │ ├── 4caroption_eBay_eng_mail_1499621651.txt │ ├── 4_From_Siski_10k2.txt_1491000382.txt │ ├── 4_From_Siski_it_10k.txt_1490990258.txt │ ├── 4_teST_1495321085.txt │ ├── 67_From_eng_doll.txt_1492817327.txt │ ├── 67_From_eng_doll.txt_1492817347.txt │ ├── 7_i_love_you_from_it.txt_1492604296.txt │ ├── alertmail.win_1500503790.txt │ ├── alessandrogarau.com.txt_1504035983.txt │ ├── amazon_1495494760.txt │ ├── amazon_mail_1495497071.txt │ ├── applestoreUK_1500976474.txt │ ├── au_ellect_from_1497233571.txt │ ├── au_name_1496957455.txt │ ├── avangate_all_1498633670.txt │ ├── barmes.org.txt_1503691010.txt │ ├── bracco.com.txt_1503578329.txt │ ├── CareerJet_name_1499637353.txt │ ├── clarence.com.txt_1503664616.txt │ ├── dada.net.txt_1503664805.txt │ ├── de_job_1493768818.txt │ ├── de_job_1496599073.txt │ ├── delivirium_1499549790.txt │ ├── delivirium_yahoo_1499832547.txt │ ├── DHL_1_1499452284.txt │ ├── DHL_2_name_1499452796.txt │ ├── dhl_name_mail_inbox_1495413602.txt │ ├── dolls_1494470012.txt │ ├── domain_random_200.txt_1503037246.txt │ ├── edimoholding.com_1502544608.txt │ ├── energheia.biz.txt_1503690876.txt │ ├── fabernet.com.txt_1503941847.txt │ ├── filecloud1.download_1501490787.txt │ ├── filescloud.download_1501491104.txt │ ├── filesservice.download_1501150204.txt │ ├── from_2907_1498686089.txt │ ├── from_amazon_eng.txt_1491827990.txt │ ├── from_amazon_name.txt │ ├── From_avangate.com_x00.txt │ ├── From_avangate.com_x01.txt │ ├── From_avangate.com_x02.txt │ ├── From_avangate.com_x03.txt │ ├── From_avangate.com_x04.txt │ ├── from_bank_of_america.txt_1498588506.txt │ ├── from_dating_eu.txt_1498482448.txt │ ├── From_DHL_eng.txt │ ├── from_domain_1503275854.txt │ ├── From_eng_Payment_to_Dynamic_link.txt_1492714363.txt │ ├── from_football_soccer.txt_1499359546.txt │ ├── From_it_1_DHL.txt_1492625979.txt │ ├── From_it_2_DHL.txt_1492719159.txt │ ├── From_it_3_Franchising.txt │ ├── From_it_INPS_numero.txt_1492713562.txt │ ├── From_MIX_1490117249.txt │ ├── From_MIX_1490297519.txt │ ├── from_new_1493182122.txt │ ├── from_test_1503266720.txt │ ├── from_test.txt_1504012534.txt │ ├── from_UK_1490618855.txt │ ├── from_usa_1.txt_1498744576.txt │ ├── from_usa_work.txt_1499094523.txt │ ├── gbart.org.txt_1504016649.txt │ ├── google_1493981310.txt │ ├── google_updates_1493981663.txt │ ├── hotmail_in_1494007126.txt │ ├── info_usa2_1494721261.txt │ ├── innovationspot.net.txt_1503664675.txt │ ├── INPS_name_mail_1494066805.txt │ ├── Inps_namemail_mail_1494168821.txt │ ├── it_dating_from.txt_1500065560.txt │ ├── job_support_from.txt_1500299542.txt │ ├── jp_1496714031.txt │ ├── jp2_1496849185.txt │ ├── lamiavinovo.com.txt_1504016995.txt │ ├── linousavacanze.com.txt_1503664545.txt │ ├── massamarittima.info.txt_1504036052.txt │ ├── massamarittima.info.txt_1504036363.txt │ ├── My_From_sexy_foto_eng.txt_1492523638.txt │ ├── name_hotel_ALL.txt_1498584527.txt │ ├── name_random_5к.txt │ ├── name_sun.txt_1497359589.txt │ ├── name_surname_100k_1494011222.txt │ ├── name_surname_1.txt_1502480925.txt │ ├── name_surname_2.txt_1502481115.txt │ ├── name_surname_3.txt_1502481158.txt │ ├── name_surname_4.txt_1502481195.txt │ ├── name_surname_5.txt_1502481235.txt │ ├── publinord.ws.txt_1503950759.txt │ ├── random_recrutingagency_party.txt_1503005449.txt │ ├── Ready_delivery_to_office.txt_1494470030.txt │ ├── recrutingagency_party.txt_1503412581.txt │ ├── static-chek.review_g_1500139926.txt │ ├── static-chek.stream_gmail_1499989761.txt │ ├── support1_1495400191.txt │ ├── support_1501506026.txt │ ├── test_domen_inbox.txt_1502562792.txt │ ├── test_domen_inbox.txt_1502567186.txt │ ├── test_from_1493639517.txt │ ├── test_from_only_name_1493639643.txt │ ├── test_from.txt_1498633309.txt │ ├── tiberiowine.com.txt_1504016710.txt │ ├── trascar.net.txt_1503664745.txt │ ├── turs_1493083639.txt │ ├── UBS_1493074956.txt │ ├── UPS_Package_eng_from.txt_1499779303.txt │ ├── usa_from_1.txt_1501523364.txt │ ├── usa_link_from.txt_1500541793.txt │ ├── usa_new_from.txt_1500574006.txt │ └── veniceout.com.txt_1503690774.txt ├── headers │ ├── 10_header_facebook.txt │ ├── 11_Header_apple_attach_1493040380.txt │ ├── 12_attach_amazon_bounce_date_1493159879.txt │ ├── 12_header_amazon_1493082981.txt │ ├── 14_iphone_alternative_1493181409.txt │ ├── 14_iphone_alternative_1493630241.txt │ ├── 14_iphone_alternative_1493637354.txt │ ├── 14_iphone_alternative_1499628491.txt │ ├── 15_Thunderbird_attach_1493181867.txt │ ├── 15_Thunderbird_attach_1493630291.txt │ ├── 15_Thunderbird_attach_1493637433.txt │ ├── 16_Thunderbird_attach_1493586522.txt │ ├── 16_Thunderbird_attach_rand_hash_experimental_1493637552.txt │ ├── 17_unsubscribe_1493811803.txt │ ├── 18_iphone_html_1494171962.txt │ ├── 19_Thunderbird_attach_1494472651.txt │ ├── 1_Header_texh_html_plain.txt │ ├── 20_1494693870.txt │ ├── 20_header_alternative_Attach_HYGB_1497224110.txt │ ├── 21_html_attach_NEW_HYGB_1494710841.txt │ ├── 22_html_alternative_mailchimp_1496711621.txt │ ├── 22_html_alternative_mailchimp_2_1503874905.txt │ ├── 22_html_attach_NEW_1494715125.txt │ ├── 23_alternative_attach_1497380392.txt │ ├── 23_gmail_1494796068.txt │ ├── 24_alt_1495319973.txt │ ├── 24_gmail_alt_1495287159.txt │ ├── 24_gmail_alt_1496707452.txt │ ├── 24_gmail_alt.txt_1503412896.txt │ ├── 25_gmail_html_1495496025.txt │ ├── 25_gmail_html_1496850848.txt │ ├── 27_gmail_alt2_1499208332.txt │ ├── 28_gmail_alt_attach_1499275834.txt │ ├── 28_gmail_alt_attach_html_1499465029.txt │ ├── 2_Headers_attach_plain.txt │ ├── 30_mailru_alt_1499556441.txt │ ├── 31_Header_apple_attach_jpg_1500907193.txt │ ├── 31_yahoo_alt_1499819506.txt │ ├── 33_gmail_alternative_attach_pdf_1501492363.txt │ ├── 33_gmail_alternative_attach_pdf_1501492489.txt │ ├── 34_gmail_alternative_1501545222.txt │ ├── 35_bat_alt_1501894778.txt │ ├── 36_base_1503084233.txt │ ├── 3_Headers_attach_html_Standart.txt │ ├── 4_Headers_text_html_Standart.txt │ ├── 5_Headers_attach_plain_opera.txt │ ├── 6_Headers_plain.txt │ ├── 7_header_text_plain_Thunderbird_1497627417.txt │ ├── 7_header_text_plain_Thunderbird.txt │ ├── 8_Header_apple_plain_Language_1493083115.txt │ ├── 8_Header_apple_plain_Language_NEW_1495175049.txt │ ├── 9_Header_apple_alt.txt │ ├── gmail_alt2.txt_1504005606.txt │ ├── Header_17_unsubscribe_1493811803.txt │ └── header_test_1503266694.txt ├── texts │ ├── 1_DHL_attach_eng_L.txt_1499371188.txt │ ├── 1_interesed.txt_1492900618.txt │ ├── 2_dynamic_attach_eng_L.txt_1499371339.txt │ ├── 2_text_ebay_it.txt_1490959305.txt │ ├── 3_de_job_.txt_1491239495.txt │ ├── 3_tax_attach_eng_L.txt_1499371464.txt │ ├── 4_amazon.txt_1490958378.txt │ ├── 4_Australia_TAX_eng_L.txt_1499417428.txt │ ├── 4_Australia_TAX_eng_L.txt_1499417837.txt │ ├── 4caroption_eBay_eng_FILE1.txt_1499619237.txt │ ├── 4caroption_eBay_eng_L.txt_1499619237.txt │ ├── 5_text_amazon_it.txt_1490959557.txt │ ├── 6_Text_Siski_it.txt_1490988582.txt │ ├── 7_i_love_you_text_it.txt_1492604199.txt │ ├── 8_Text_Siski_it.txt_1491082869.txt │ ├── 9_text_delivered.txt_1492817302.txt │ ├── amazon_my.txt_1492731853.txt │ ├── amazon_my.txt_1495491171.txt │ ├── au2.txt_1496958727.txt │ ├── au2.txt_1496959106.txt │ ├── AU_tax_return_letter.txt_1490578821.txt │ ├── avangate1.txt_1495554165.txt │ ├── ay_dating_letter.txt_1496954713.txt │ ├── base2.txt_1503085620.txt │ ├── base3.txt_1503088608.txt │ ├── base4.txt_1503270311.txt │ ├── base.txt_1503011850.txt │ ├── bat_text_html.txt_1501896961.txt │ ├── boa_sun1.txt_1499272472.txt │ ├── body_iphone_job.txt │ ├── ch_delivery.txt_1493224398.txt │ ├── chek_payment_alt.txt_1496187430.txt │ ├── dating_microtext_usa.txt_1503160325.txt │ ├── dating_test_mini_eng.txt_1502205380.txt │ ├── dating_test.txt_1494521813.txt │ ├── dating_test.txt_1494527749.txt │ ├── de_job_file1.txt_1496601319.txt │ ├── de_job.txt_1496598300.txt │ ├── email_for_au.txt_1497233134.txt │ ├── email_for_au.txt_1497245685.txt │ ├── es_dating_L.txt_1500034839.txt │ ├── eu_dating.txt_1497358926.txt │ ├── facebook_html.txt_1492796202.txt │ ├── FILE1_Amazon_eng.txt_1491823527.txt │ ├── file1_football_soccer.txt_1499359455.txt │ ├── file1.txt_1492650970.txt │ ├── file1.txt_1492734763.txt │ ├── file1.txt_1495491436.txt │ ├── file1.txt_1500976013.txt │ ├── FILE1_usa_avavangate.com.txt_1495115614.txt │ ├── file2.txt_1492650922.txt │ ├── file2.txt_1495491436.txt │ ├── FIle_3_IM.txt │ ├── file3.txt_1495491436.txt │ ├── File3.txt_1501139373.txt │ ├── file4_src_jpg.txt_1495492916.txt │ ├── File4.txt_1501139373.txt │ ├── File5.txt_1501139373.txt │ ├── file_adress_amazon.txt_1492734763.txt │ ├── FILE_Amazon_eng.txt_1491913326.txt │ ├── FILE_avangat_2.txt_1495562461.txt │ ├── file_avangate1.txt_1495555049.txt │ ├── FILE_letter.txt_1501139310.txt │ ├── file_src_jpg.txt_1492734763.txt │ ├── from_amazon_name.txt_1492898081.txt │ ├── i_love_you_eng.txt_1491149781.txt │ ├── it_dating_3.txt_1500913263.txt │ ├── it_dating_Let.txt_1500751935.txt │ ├── it_dating_L.txt_1500063697.txt │ ├── jp2.txt_1496849067.txt │ ├── letter_bank_of_america.txt_1498588438.txt │ ├── letter_football_soccer.txt_1499359419.txt │ ├── letter_hotel_1.txt_1498584141.txt │ ├── letter_hotel_1.txt_1498584220.txt │ ├── letter_hotel_2.txt_1498584267.txt │ ├── links.txt_1494195446.txt │ ├── log.txt_1494622256.txt │ ├── log.txt_1494629172.txt │ ├── log.txt_1494674089.txt │ ├── new_text_job_1.txt_1503491266.txt │ ├── new_text_job_1.txt_1503491975.txt │ ├── new_text_job_2.txt_1503513268.txt │ ├── new_text_job_2.txt_1503513847.txt │ ├── new_text_job_2.txt_1503514648.txt │ ├── new_text_job_4.txt_1504005243.txt │ ├── new_text_job_4.txt_1504007687.txt │ ├── new_text_sunny_3.txt_1503585572.txt │ ├── new_text_sunny_3.txt_1503587878.txt │ ├── paypal_eng2.txt_1499877603.txt │ ├── paypal_eng.txt_1499876468.txt │ ├── q.txt_1495170752.txt │ ├── q.txt_1495289611.txt │ ├── q.txt_1495319796.txt │ ├── Ready_delivery_to_office.txt_1494469448.txt │ ├── Ready_delivery_to_office.txt_1494515290.txt │ ├── sanny_14.txt_1502306947.txt │ ├── Sunnu12.txt_1501537064.txt │ ├── sunny10.txt_1499888822.txt │ ├── sunny11.txt_1499906216.txt │ ├── sunny13.txt_1501874288.txt │ ├── sunny15.txt_1502372209.txt │ ├── sunny16.txt_1502372439.txt │ ├── sunny17.txt_1502372547.txt │ ├── sunny18.txt_1502372622.txt │ ├── sunny19.txt_1502373282.txt │ ├── sunny20.txt_1502373513.txt │ ├── sunny21.txt_1503006782.txt │ ├── sunny3.txt_1497600825.txt │ ├── sunny4.txt_1497600874.txt │ ├── sunny5.txt_1498165181.txt │ ├── sunny5.txt_1498597270.txt │ ├── sunny6.txt_1499128710.txt │ ├── sunny7.txt_1499607299.txt │ ├── sunny8.txt_1499637827.txt │ ├── sunny9.txt_1499806717.txt │ ├── TEST1.txt_1503256241.txt │ ├── TEST1.txt_1503419748.txt │ ├── TEST2.txt_1503256791.txt │ ├── TEST2.txt_1503420998.txt │ ├── TEST3.txt_1503257293.txt │ ├── TEST4.txt_1503258181.txt │ ├── TEST4.txt_1503258897.txt │ ├── TEST4.txt_1503260263.txt │ ├── TEST4.txt_1503260746.txt │ ├── TEST4.txt_1503261527.txt │ ├── TEST4.txt_1503262002.txt │ ├── TEST4.txt_1503262222.txt │ ├── TEST4.txt_1503262419.txt │ ├── TEST4.txt_1503412639.txt │ ├── test_letter_link.txt_1501530877.txt │ ├── test_text.txt_1493152409.txt │ ├── test_text.txt_1493584341.txt │ ├── test_text.txt_1493637625.txt │ ├── test_text.txt_1493638510.txt │ ├── test.txt_1493981966.txt │ ├── test.txt_1494015665.txt │ ├── test.txt_1494170610.txt │ ├── test.txt_1494190737.txt │ ├── test.txt_1496856580.txt │ ├── test.txt_1496888390.txt │ ├── text_amazon_original.txt_1491913246.txt │ ├── Text_avangate_2.txt_1495562461.txt │ ├── Text_DHL_eng.txt │ ├── text_dolls_de.txt_1494526321.txt │ ├── Text_eng_1_Payment_to_Dynamic_attach.txt_1491822080.txt │ ├── Text_eng_1_Payment_to_Dynamic_link.txt_1491822009.txt │ ├── Text_eng_2_Tax_Return.txt_1491830271.txt │ ├── Text_it_1_DHL.txt_1492625914.txt │ ├── Text_it_2_DHL.txt_1492718272.txt │ ├── Text_it_3_Franchising.txt │ ├── Text_it_9_Automazioni_SRL.txt │ ├── Text_it_INPS_numero.txt_1492713471.txt │ ├── text_sun.txt_1497359611.txt │ ├── text_temp.txt_1496702969.txt │ ├── text_test_it_kykla.txt_1494497233.txt │ ├── text.txt_1496702567.txt │ ├── Text_usa_avangate.com.txt │ ├── tr.txt_1494544309.txt │ ├── turs.txt_1493079488.txt │ ├── UBS.txt_1493074312.txt │ ├── uk_link_letter_1.txt_1500929947.txt │ ├── uk_link_letter_2.txt_1500930004.txt │ ├── uk_link_letter_3.txt_1500930043.txt │ ├── UPS_Package_eng_L.txt_1499779328.txt │ ├── usa_letter_work.txt_1499092945.txt │ ├── usa_link_L.txt_1500541823.txt │ └── voice.txt_1501495005.txt └── topics ├── 1_DHL_attach_eng_T.txt_1499371290.txt ├── 1_interesed.txt_1492900867.txt ├── 2_dynamic_attach_eng_T.txt_1499371405.txt ├── 3_tax_attach_eng_T.txt_1499371429.txt ├── 3_test_iphone_1495174121.txt ├── 4_Australia_TAX_eng_T_1.txt_1499417939.txt ├── 4_Australia_TAX_eng_T.txt_1499417917.txt ├── 4caroption_eBay_eng_T.txt_1499618513.txt ├── 4_Topics_Siski_it.txt_1490989637.txt ├── 67_subj_delivered.txt_1492817707.txt ├── 7_i_love_you_subj_it.txt_1492604609.txt ├── amazon_1495494546.txt ├── au_ellect_topic_1497233472.txt ├── avangate1_1495553971.txt ├── blabla_1492920917.txt ├── boa_sun1_1499272237.txt ├── dating_microtopicks_usa.txt_1503160270.txt ├── dating_T_mini_eng.txt_1502206538.txt ├── de_job_1493768439.txt ├── de_job_1496599015.txt ├── doll_it_1494515391.txt ├── doll_it_1494515396.txt ├── dolls_1494467945.txt ├── es_dating_T.txt_1500034879.txt ├── it_dating_3_1500913341.txt ├── it_dating_topics.txt_1500752004.txt ├── it_dating_T.txt_1500064572.txt ├── Job19_1503093829.txt ├── jp_1496713959.txt ├── jp2_1496849153.txt ├── last_delivery_1494034292.txt ├── new_1502833452.txt ├── random_topics.txt_1501139474.txt ├── Ready_delivery_to_office.txt_1494467975.txt ├── subj_de_job.txt_1491240680.txt ├── subjects.txt ├── Subject_usa_avangate.com.txt ├── subj_i_love_you_eng.txt_1491150283.txt ├── subs.txt ├── sunny11_1499906420.txt ├── sunny_1496702357.txt ├── sunny_topics_3.txt_1498628765.txt ├── support1_1495400412.txt ├── tema_hotel_1.txt_1498584465.txt ├── tema_hotel_2.txt_1498584485.txt ├── test_subject.txt_1490959653.txt ├── test_sunny_1495292663.txt ├── test_topics_1493157738.txt ├── test_topics_1493584711.txt ├── test_topics_1493584715.txt ├── test_topics_1493637689.txt ├── test_topics_info_1493638699.txt ├── Text_it_9_Automazioni_SRL.txt ├── topics_amazon_eng.txt_1491829245.txt ├── Topics_au_dating.txt_1496956544.txt ├── Topics_avangat_2.txt_1495563054.txt ├── topics_bank_of_america.txt_1498588479.txt ├── Topics_DHL_eng.txt ├── topics_dolls_de.txt_1494526297.txt ├── Topics_eng_1_Payment_to_Dynamic_link.txt_1491822051.txt ├── Topics_eng_2_Tax_Return.txt_1491830327.txt ├── topics_football_soccer.txt_1499359223.txt ├── Topics_it_1_DHL.txt_1492625931.txt ├── Topics_it_3_Franchising.txt ├── Topics_it_9_Automazioni_SRL.txt ├── Topics_it_INPS_numero.txt_1492713553.txt ├── topics_new_sunny_4.txt_1498681420.txt ├── topics_new_synny_5_1498789445.txt ├── topics_sunny_1.txt_1503412762.txt ├── topics_sunny_2.txt_1498043022.txt ├── topics_sunny_2.txt_1503419871.txt ├── topics_sunny_3.txt_1503422549.txt ├── topics_sunny_4.txt_1503422954.txt ├── topics_sun.txt_1497359632.txt ├── topic_test_1503266611.txt ├── turs_1493079770.txt ├── UBS_1493074408.txt ├── uk_link_topics.txt_1500933150.txt ├── UPS_Package_eng_T.txt_1499779280.txt ├── usa_link_T.txt_1500542328.txt ├── usa_topics_work.txt_1499092982.txt ├── usa_topics_work.txt_1499093014.txt ├── usa_topics_work.txt_1499093078.txt ├── us_job1_1499508816.txt └── voice_1501497299.txt 33 directories, 1135 files
As we go through the files we will start to import them into our engine so that existing customers can pull this into any type of system you may have or need for correlation with SIEM and other systems so that you can automate the defense process.
Many of the files also have IP and Domain relevant information which makes the data more interesting for attackers because other dumps contain many of these emails with passwords from previous dumps (so if you didn’t change your passwords on ALL your email services, now is certainly a great opportunity to do just that).
Hope this info was useful, enjoy!
1D10T