t.me
Disclosed Sep 29, 2026
A stealer log compilation distributed by the 'White Cloud' Telegram channel, containing approximately 1.7 million URL:login:password credential triplets aggregated from infostealer malware. The data spans hundreds of different websites and services globally including Google, PayPal, Roblox, Amazon, Discord, GitHub, and many others. Not a single-company breach — this is a multi-source credential stuffing/stealer log dump.
Data found in this dataset
Search this dataset
Team members search this dataset here and through the API. Access is by invitation from your team admin, or by request.
Source files
Expand any file to inspect its column headers and the field each maps to.
1.7M URL-LOGIN-PASS 29.09.2026 WHITE CLOUD.txt2 columns1,559,668 rows
File structure
| Source column | Mapped field | Confidence |
|---|---|---|
| 0 | username | high |
| 1 | password | high |
Notes: Raw data shows patterns like 'username:password' or 'url:username:password'. No clear email/DOB/SSN/phone detection in the first 50 lines; only username and password are consistently present.