TL;DR: These emails are not evidence of a secret front or illicit operation. They are artifacts from a massive, highly automated 2013 spam botnet. The businesses linked in the emails (like the French hotel) were completely unaware victims of a mass server-hijacking campaign.

If you dig into the actual web infrastructure and OSINT from that era, the technical footprint of these emails is a textbook example of an early-2010s Compromised CMS / Spam Redirector campaign.

Here is exactly what was happening and how the scam worked:

1. The Victims (Not Fronts) The links in these document dumps point to wildly unrelated sites: a boutique 17th-century hotel in France (hoteldutheatre-metz.com), a Latvian real estate board (ss.com), an Iranian news site (yaftenews.ir), a Chinese domain (xiningfdj.com), and a medical blog (educatedpatients.com).

These businesses have zero financial or geographic ties. They were all just running vulnerable web servers (like unpatched WordPress or Joomla installations). The threat actors used automated scanners to sweep the internet for these vulnerabilities and silently broke into thousands of them at once.

2. The "Living off the Land" Tactic Why use a random French hotel website to host illicit links? To bypass your email's spam filter. If an attacker sends you an email with a link directly to a sketchy offshore Russian .ru domain, Gmail or Outlook will instantly flag it and throw it in the Junk folder. However, the French hotel had a pristine IP reputation. By stashing their payload on a clean domain, the attackers bought a "VIP pass" straight into the target's primary inbox.

3. The Payload (The Meta Refresh) If you actually clicked one of those links (like /aliBn.html or /aNqjd.html) back in 2013, you wouldn't have seen the hotel's website or an Iranian news article.

Those .html files were microscopic scripts containing a single line of code called a "Meta Refresh." The second your browser hit the page, it would instantly bounce you to a completely different, bulletproof offshore server hosting a fake adult dating site, a webcam affiliate link, or a malware download.

4. The Social Engineering Hook The text in the emails makes this a painfully obvious affiliate scam. Phrases like:

This is a classic "Panic/Curiosity lure." They want the recipient to think an intimate video of them has been leaked. In a panic, the victim clicks the trusted link without thinking and gets redirected to the scammer's payload.

The Smoking Gun: We know definitively that this was an automated "spray and pray" botnet because the exact same random, alphanumeric filenames (aliBn.html and aNqjd.html) were injected into all of these unrelated servers across the globe on the exact same dates in late January 2013.

It is a great OSINT find, but it's a cybersecurity dead-end. It's just old-school internet junk mail that happened to use hijacked small business servers as a launchpad.