Dashboard

About stealerlogs

stealerlogs is a search index of infostealer dumps. Type an email, username, URL, password, or IP. A hit is one saved login from one infected machine.

What it searches

The index holds 44 billion records from 37 million machines. A search looks at stealer logs and combo lines. Combo lines are login and password pairs without the rest of the box.

What a hit includes

Origin, login, password, source, and post date. Source is the Telegram channel or bot the file came from. Opening a stealer-log hit shows the other accounts, cookies, autofill, wallets, Discord and Telegram tokens, and system info from that machine.

Search without a plan

Search is open. Without a plan the table can hide origin, login, and password, or show only part of them. Source and date stay visible. A plan unlocks the full fields, file contents, and the API. Plans start at $20 a month.

How the index is built

Telegram bots and channels circulate the dumps. Collectors pull those files and we index each login. We do not run the malware. The sources page explains the pipeline and the 10,000-record window.

Who it is for

Investigators, security teams, and anyone who wants to know if a login is already in circulation. A company domain search finds staff and customer addresses. If a login of yours is in a result, read what to do.

Contact

[email protected], or the Telegram channel @stealerlogsdotcom.

Questions

Is search free?
Yes. A plan is needed for full origin, login, and password, for file contents, and for the API.
Where do the logs come from?
Telegram bots and channels post the dumps. We collect those files and index each login.
Why do results stop at 10,000?
Elasticsearch refuses a from and size query past 10,000 hits. A search can match more.

Search an email, username, URL, password, or IP. Open search.

More