This page is a sub page of the case file for case DIVD-2026-00007 - Victim Notification Operation Endgame S03E03, which contains the general information about this case.
Is my organisation/constituency impacted?
To determine if your organisation/constituency is impacted, you can download our apex lists:
What is in these apex lists?
SocGholish
The SocGholish archive contains four files:
- DIVD-2026-00007-SocGholish-admin-email_apexs.csv -> Apex domains and record counts of the email address part of WordPress administrator accounts
- DIVD-2026-00007-SocGholish-admin-url_apexs.csv -> Apex domains and record counts of the url of compromised WordPress servers
- DIVD-2026-00007-SocGholish-victim-email_apexs.csv -> Apex domains and record counts of the email addresses of victims of infostealer malware dropped by SocGholish
- DIVD-2026-00007-SocGholish-victim-url_apexs.csv -> Apex domains and record counts of the target urls of accounts stolen by infostealers dropped by SocGholish
What should I do if members of my organisation/constituency are in the apex files
Contact us via DIVD-2026-00007@csirt.divd.nl. Provider us with a list of domains from the apex lists that you would like to recive information about and demonstrate to us that you own the domain/have a legitimate interest to obtian the information.
In order to address ethical concerns regarding the sharing of PII with government organisations of countries with a less than ideal situation with regard to the upholding of human rights, we will only provide data to government organisations of countries that score higher than 0.4 in the most recent year of the Human rights index.
More questions?
The main case file contains a Frequently Asked Questions (FAQ) section. If that does not answer your questions, please reply to the email you received or email us at DIVD-2026-00007@csirt.divd.nl.
For more information, see the main case file.