Where stealer logs come from

Telegram bots

Operators and resellers post stealer dumps on Telegram. Channels drop zip archives on a schedule. Bots announce new files and hand out download links. We subscribe to those channels and bots, pull the archives, parse the files, and index each login. The Source column is the channel or bot name.

What gets parsed

A typical dump has:

• A passwords file
• Cookie stores
• Autofill
• Wallet files
• Messenger tokens
• A system info file

Each password line becomes a searchable record. Opening the log shows the rest of that machine. What is a stealer log.

What we do not do

We do not infect computers. We do not write stealers. We do not claim the index holds every log that exists. Files that never hit a channel we watch are not here.

Why results stop at 10,000

The search index is Elasticsearch. A from and size query cannot pass index.max_result_window. The default is 10,000. Going further with from and size is expensive, because each page has to score and sort every earlier hit. This index keeps that window.

A query can match more than 10,000 records. The count you see may be 10,000 even when more exist. You can page through those 10,000. You cannot page past them.

How to see a different slice

Search a full email instead of a domain. Search a login URL instead of a company name. Turn on Hide results with no files if you need the box, not combo lines. Use a tighter wildcard. A domain search that hits the window is a sign to split the query.

Posted date

Posted is when the file appeared in a channel, not when the machine was infected. Infection can be months earlier.