I think you are right. A bunch of them appear to be some sort of redirect attack (I'll have to read that link you posted). In other cases I see the just upload files directly such as: https://www.rld.nm.gov/wp-content/uploads/2025/06/z7ot3u38jf... or in that original link I posted it looks like they took over the entire subdomain somehow.

I have quite a few more examples but they are too explicit to post.

My thought on this matter is, if we can't get this contained now on .gov websites then how will we be able to handle malicious spammers when they fully realize the power of AI driven spam attacks? I think things will get out of control real fast very soon.