Redline Stealer Logs 15M Compilation
Disclosed Oct 11, 2026
A compilation of approximately 15 million credential records harvested by the Redline information-stealing malware. The data is in URL:login:password (ULP) format and contains credentials from a wide variety of websites including social media (Facebook, Instagram), gaming (Roblox, Minecraft), financial services (PayPal, PerfectMoney), and many others. The records span multiple countries and languages, consistent with a broad infostealer campaign rather than a single targeted breach.
Data found in this dataset
Search this dataset
Team members search this dataset here and through the API. Access is by invitation from your team admin, or by request.
Source files
Expand any file to inspect its column headers and the field each maps to.
15kk ulp.txt2 columns14,883,282 rows
File structure
| Source column | Mapped field | Confidence |
|---|---|---|
| 1 | high | |
| combo identifier column — values parse as email addresses | ||
| 2 | password | high |
| combo secret column — value adjacent to the email identifier | ||
Notes: Heuristic auto-detection: credential combo list