Third-party hosts observed referring victim traffic into the SecureLeaf sinkhole for gettrumpmemestrendingtokens.com. Each host below served the campaign's obfuscated JavaScript loader; the loader's asset fetch leaked the compromised host in the Referer, confirming an active infection at time of observation.
The campaign injects an obfuscated JavaScript loader into compromised third-party sites. On page load, the loader beacons to gettrumpmemestrendingtokens.com to pull staging assets. That domain is sinkholed to SecureLeaf infrastructure, so the asset request lands on /sink.html carrying the compromised page's URL in the Referer header — which uniquely identifies the infected host. Hosts are only listed when a non-sinkhole, non-search-engine Referer was observed.
Every host in this registry is a victim of the campaign, not an operator of it. These are legitimate sites running an injected loader against their owners' knowledge. They are published here for notification and defensive awareness so operators can remediate — they must not be added to IP/domain blocklists or abuse reports. Only campaign-operated infrastructure (C2, TDS, staging) is eligible for takedown action.
| # | Compromised host | First seen | Last seen | Days | Hits | Victim IPs | Deep paths observed |
|---|---|---|---|---|---|---|---|
| 1 | apgschool.com | 2026-07-31 | 2026-07-31 | 1 | 1 | 1 | — |
| 2 | martvarauto.ee | 2026-07-31 | 2026-07-31 | 1 | 1 | 1 | — |
| 3 | munis-minibus.com | 2026-07-31 | 2026-07-31 | 1 | 1 | 1 | — |
| 4 | siecap.com.au | 2026-07-31 | 2026-07-31 | 1 | 1 | 1 | — |
| 5 | tescomamalta.com | 2026-07-31 | 2026-07-31 | 1 | 1 | 1 | — |
| 6 | valeroon.ee | 2026-07-31 | 2026-07-31 | 1 | 1 | 1 | — |
| 7 | www.besen-group.com | 2026-07-31 | 2026-07-31 | 1 | 1 | 1 | /es/products/ev-charging-accessories/evp001-l/ |
| 8 | www.hull2prop.com | 2026-07-31 | 2026-07-31 | 1 | 1 | 1 | — |
| 9 | adventistai.lt | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 10 | banglabetaff.com | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 11 | bettansshoes.com | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 12 | designerbridalroom.com.hk | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 13 | manuelapicard.hr | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 14 | mityaalim.co.il | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 15 | modded-1.com | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 16 | naasongsmix.com | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 17 | pronadji.ba | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 18 | regionpro.by | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 19 | sacsingapore.org | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 20 | skytech.lk | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 21 | trexlebanon.com | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 22 | utech.ac.sz | 2026-08-01 | 2026-08-01 | 1 | 1 | 1 | — |
| 23 | abacusparenteral.com | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 24 | andstudio.lt | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 25 | classroom.mindloops.org | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 26 | dbrweddings.com | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 27 | holtegard.no | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 28 | ibrahimstores.com | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 29 | jerseys.co.ke | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 30 | mv66-m.com | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 31 | wissmann.co.il | 2026-08-02 | 2026-08-02 | 1 | 1 | 1 | — |
| 32 | savincie.fr | 2026-08-03 | 2026-08-03 | 1 | 8 | 7 | — |
| 33 | www.artistamplifier.com | 2026-08-04 | 2026-08-04 | 1 | 8 | 4 | — |
| 34 | thotflix.com | 2026-08-04 | 2026-08-14 | 2 | 9 | 2 | /page/3/?s=Demi+Moore |
| 35 | aramont.com | 2026-08-04 | 2026-08-04 | 1 | 1 | 1 | — |
| 36 | jumbocheap.com | 2026-08-04 | 2026-08-04 | 1 | 1 | 1 | — |
| 37 | thehypicapk.com | 2026-08-04 | 2026-08-04 | 1 | 1 | 1 | — |
| 38 | verrerie-farinelli.com | 2026-08-04 | 2026-08-04 | 1 | 1 | 1 | — |
| 39 | www.hotel-marko.at | 2026-08-04 | 2026-08-04 | 1 | 1 | 1 | — |
| 40 | esto.com.eshigh-yield | 2026-08-06 | 2026-08-06 | 1 | 8 | 8 | — |
| 41 | maideesriprachin.com | 2026-08-06 | 2026-08-06 | 1 | 1 | 1 | — |
| 42 | oumma.com | 2026-08-09 | 2026-08-09 | 1 | 8 | 2 | /categorie/societe/divers-societe/ |
| 43 | www.thestreambible.com | 2026-08-09 | 2026-08-09 | 1 | 8 | 2 | /netflix/watch-la-la-land-netflix/ |
| 44 | biographyer.com | 2026-08-09 | 2026-08-09 | 1 | 32 | 1 | /cute-watercolor-compass-tattoos-for-women/ |
| 45 | www.thestarmagazine.com | 2026-08-09 | 2026-08-09 | 1 | 1 | 1 | — |
| 46 | signaturelimony.com | 2026-08-13 | 2026-08-13 | 1 | 1 | 1 | — |
| 47 | gibamretail.com | 2026-08-14 | 2026-08-14 | 1 | 4 | 1 | /en/ |
| 48 | travefy.com | 2026-08-17 | 2026-08-17 | 1 | 4 | 1 | — |
| 49 | fire-quip.co.zahigh-yield | 2026-08-18 | 2026-08-18 | 1 | 44 | 18 | /product-category/fire-equipment/, /product-category/personal-protective-equipment/ |
| 50 | tourinthecity.comhigh-yield | 2026-08-18 | 2026-08-20 | 2 | 24 | 12 | /tour-category/vatican-tours/ |
| 51 | jmaluminium.com | 2026-08-18 | 2026-08-18 | 1 | 8 | 7 | — |
| 52 | aluminioscuesta.com | 2026-08-18 | 2026-08-18 | 1 | 1 | 1 | — |
| 53 | fremontchapeloftheroses.com | 2026-08-18 | 2026-08-18 | 1 | 1 | 1 | — |
| 54 | storesdomino.us | 2026-08-18 | 2026-08-18 | 1 | 1 | 1 | — |
| 55 | legaldocs101.comhigh-yield | 2026-08-19 | 2026-08-19 | 1 | 8 | 8 | /?o=30140754031100 |
| 56 | www.tunis-airport.com | 2026-08-19 | 2026-08-19 | 1 | 8 | 6 | — |
| 57 | everyinvestor.co.uk | 2026-08-20 | 2026-08-20 | 1 | 1 | 1 | — |
| 58 | gbcu.org.ilnewest | 2026-08-23 | 2026-08-23 | 1 | 2 | 1 | — |