This presentation will discuss our research on a threat that involves the massive attacks on WordPress, Joomla and Drupal sites and where they attempt to test the waters on a new spamming cycle. This routine involves different forms of web threats working independently of each other and has posed a challenge when it comes to email authentication. We will look into the (1) compromised website, (2) compromised machine, (3) command and control server, the (4) payloads and/or aliates involved and (5) the telemetry of the data we collected.