How the Onliner Spambot Exposed 37 Million Email Addresses in 2017

HEROIC analysts identified the Onliner Spambot Email Addresses data set while tracking large-scale spambot infrastructure that was left accessable on public servers. In August 2017, security researcher Benkow discovered a spambot operation running from a server in the Netherlands that had exposed its own data files. The exposed records included 37,181,540 email addresses and usernames that the spambot had collected for use in spam campaigns, phishing attacks, and credential testing.

How 37 Million Email Addresses Fuel Phishing and Spam Campaigns

A spambot's core asset is a large, verified list of active email addresses. When criminals have this data, they can send millions of targeted phishing emails designed to steal login credentials, spread malware, or trick people into fake financial transactions. Because these email addresses were recieved and validated by the spambot before being stored, they represent real, active accounts rather than guesses, making them far more effective for attackers than randomly generated address lists.

What Was Exposed in the Onliner Spambot Email Addresses Breach

• Email Address
• Username

Why Being in a Spambot List Creates Lasting Risk

Once your email address appears in a spambot database, it circulates indefinitely. Lists like this one are sold, traded, and merged into larger collections for years. If your email was in the Onliner Spambot data, you may notice increased phishing attempts, spam, and account recovery scams targeting you. Criminals use these lists for credential stuffing attacks, trying stolen username and password combinations from other breaches against your email account. The risk of identity theft grows when spambot lists are combined with other leaked data sets.

How Database Breaches Work

This breach was unusual because the spambot operator accidentally left their own server open to the public, exposing the data they had collected. A database breach of this type does not involve hacking the victim directly. Instead, the attacker's own infrastructure was poorly secured, and a researcher found it before the spambot could close the gap. The result was the same for affected users: their email addresses and usernames became part of a publicly available data set that has since been incorporated into dozens of breach databases worldwide.

Check If Your Data Was Exposed

HEROIC's free breach scanner covers over 400 billion exposed records, including large spambot collections like the Onliner data set. If your email address was harvested by this spambot, you will see it in your results. Run a free scan at HEROIC today to find out where your data has appeared and get clear guidance on what to do next.