t.me
Disclosed Sep 21, 2026
A stealer log compilation distributed via the 'White Cloud' Telegram channel, containing approximately 1.7 million URL:login:password credential triplets. The data appears to be aggregated from infostealer malware targeting primarily German-language users (.de domains dominate), including credentials for Amazon, eBay, PayPal, web.de, and many other German e-commerce and service sites. Format is URL:username/email:password. The date '21.09.2026' in the filename appears to be the distribution date on the channel.
Data found in this dataset
Search this dataset
Team members search this dataset here and through the API. Access is by invitation from your team admin, or by request.
Source files
Expand any file to inspect its column headers and the field each maps to.
1.7M URL-LOGIN-PASS 21.09.2026 WHITE CLOUD.txt2 columns1,647,562 rows
File structure
| Source column | Mapped field | Confidence |
|---|---|---|
| 1 | high | |
| combo identifier column — values parse as email addresses | ||
| 2 | password | high |
| combo secret column — value adjacent to the email identifier | ||
Notes: Heuristic auto-detection: credential combo list