A bank-account listing dated 1 January 2026 asked CAD 190, with a separate line claiming a chequing balance of “9k” and no currency. It carries the “Botnet Log” label in our collection (SC-O001). Nothing in the post says the data came from an infected machine, and the balance is the poster’s untested claim.
That gap between label and goods is the subject of this article. In the posts we read between 1 January and 27 October, the same labels cover bank listings, game accounts, buyer rate sheets, credential-file subscriptions and personal-data lookups. Each exposes a different asset, so each needs a different response.
What a Botnet Log Post Actually Offers
We read 160 kept posts from the Botnet Log class, drawn at random with weights and labelled blind to our classifier. Bank-account listings and requests came to 23.8% (95% interval 17.1 to 31.1). Game-account lots, mostly Indonesian-language (24 of 30) and described by their in-game contents, came to 21.3% (15.1 to 28.0), a moderate-confidence reading (SC-O008, SC-O010).
Buy-side posts made up 17.0% (11.1 to 23.0). In these, the poster pays for accounts or cookie files that others submit. One sheet lists three Facebook products with per-ID rates in taka, rising from 12.00 to 13.00 for larger batches of the first (SC-O011). It states what the poster says it pays, and it does not say where the accounts come from.
Strict stealer-log clouds were a weighted 6.3% (2.6 to 10.4), or 7.4% if unpriced promotions are added. Unweighted, they were 9 of the 160 posts read (5.6%). “Strict” means priced or joinable feeds and log packs said to come from infected machines. One post separates credential lines, full logs and a live feed into weekly and monthly tiers (SC-O019).
A further 11.3% contained no offer, such as a forum reply stub (SC-O040). Tools, credential files, other account lots and unidentifiable “log” posts share the rest.
Across the Combolist, Botnet Log and keyword sets together, about 190,000 cleaned posts, strict clouds come to roughly 2.2% (0.9 to 6.0). That figure leaves out the breach-bot set, whose posts are personal-data queries. The interval combines the Botnet Log hand sample, an upper bound of 3 in 80 for Combolist and unaudited classifier shares for the keyword set. The Botnet Log share is the number that matters for the label itself.
Combolist Posts Sell Files, Pointers and Time
In the 80 Combolist posts we read, credential files and pointers were the largest group at 36.8% (25.8 to 47.7). Accounts offered for sale were 18.9%, buy-side posts 11.9% (4.6 to 20.7), requests for logs or files 7.0%, and about a fifth were not offers. Free shares made up 21.4% of the class by commercial mode, so the money sits elsewhere.
A locked free drop advertises a paid cloud, with a three-day trial at $7 and a monthly plan at $50 (SC-O027). Another cloud lists three days for $5 and three months for $90, and calls its lists fresh, private and verified (SC-O028).
The free file is the advert. The product on sale is continuing access to a cloud, priced by the period. Among 175 bulk-combolist asking posts in the Combolist class that state an amount, 97 state an access period and one a per-line price; most of the rest give no unit. Our unit extractor is only 49 to 74% accurate, so read that as a pattern, not a count.
That is the product sellers advertise, not a measured exposure. The posts do not show what a buyer receives while a plan runs, or whether it is renewed.
The breach-bot class is a third thing. A pay-per-query service lists SSN and date-of-birth lookups at $2.4 each (SC-O021). That sells a query over personal data, not an account. A calibrated estimate puts lookup services at about half of the kept posts in that class (52%, interval 42 to 62).
Why Sellers Call Any Packaged Account a “Log”
In these posts a “log” can be any packaged account, whatever its source. An Indonesian lot of game accounts is priced “per log” (SC-O010), and the bank listing that opened this article uses the same word. The stealer-cloud tiers use it for raw machine output. Because one word spans such different goods, a feed that counts “logs” counts the word, not the product.
The products are not fully separate, though. Credential files and clouds can be linked in supply, since combined URL, login and password files are often compiled from stealer output. Cookie and session files can likewise come from infected browsers. The posts rarely say, so the origin question belongs to the infostealer chapter, which covers the stealer families and the log supply chain.
Each Product Calls for a Different Control
Set side by side, the products differ in their unit of sale and in what a buyer would hold afterwards. That second column decides the defence.
| Product in the posts | Unit in the post | What it exposes | Control it calls for |
|---|---|---|---|
| Combolist file or cloud subscription (SC-O028, SC-O027) | Access period; per-line prices are rare | Credential pairs, useful where people reuse passwords; origin often unstated | Breached-password screening, login rate limits and MFA against credential stuffing |
| Session package or cookie material (SC-O035) | Per piece; 0.22 USD in one messaging-app package | A logged-in session, if still live; origin not shown | Session revocation, short lifetimes, re-authentication for risky actions |
| Bank-account listing (SC-O001 to SC-O005) | Per listing; claimed balance kept separate | A claimed bank-account login, sometimes with its mailbox | Fraud controls on new devices, payees and withdrawals |
| Game-account lot (SC-O008 to SC-O010) | Per lot or per account; unit and currency often unstated | A consumer game account | Mostly platform-side recovery |
| Buy-side rate sheet (SC-O011 to SC-O013) | Per submitted ID, implied | Demand: the platforms and attributes wanted, such as cookie or 2FA secret | A signal for platform trust and safety, not an exposure of your users; see buyer rate sheets |
| Stealer-log cloud (SC-O019, SC-O020) | Weekly or monthly subscription | What the seller says came from infected machines: credentials and cookies | If your users match, treat the device as compromised: reset, revoke sessions, clean the endpoint |
| Lookup bot (SC-O021) | Per query | Personal data, not an account | Do not rely on knowledge-based identity checks |
Cookie material is the case where a password reset alone may leave the session alive, which is why session revocation matters in the session hijacking pattern. Bank listings belong to the Fraud chapter, which applies the same rule we do: an asking price and a claimed balance are different quantities and are never compared. One listing claims that the linked mailbox has no 2FA (SC-O005).
Is This Just a Noisy Classifier?
The strongest objection is that the labels are noise, so the mix describes the labelling and not the trade. Part of that is true, because the class label comes from the collection and is loose. About 11% of the hand-read Botnet Log posts and about a fifth of the Combolist posts contained no offer. Only 6.4% of raw Botnet Log posts and 18.5% of raw Combolist posts survive cleaning, mostly because the rest is off-topic text or repeated bot output.
The composition, however, comes from full-text readings and not from our classifier. That classifier agrees with the hand labels at group level only 70 to 74% of the time. Its errors on stealer clouds run both ways, with precision of 0.375 on the clean evaluation sample and 0.45 on a tuned one.
We therefore quote hand labels. A second AI reader re-labelled 50 posts blind and agreed on the form group in 94% of cases (kappa 0.90), which is a cross-check and not a human audit.
The shares describe kept posts, not sellers or sales, and one cloud post can front far more credentials than one game lot. A small post share is therefore not a small exposure. The intervals run about seven points either way for Botnet Log and wider for Combolist, and class labels changed between May and July, so we draw no trend. The text of each post is cut at 1,500 characters in our cleaned copy.
Corporate Accounts Are a Small Share
The share is small and the evidence thin. An October post offers Office 365 mailboxes with cookies and contact lists but shows no price (SC-O036). An August post is a menu of corporate and education access types, at the boundary with access sales (SC-O037).
Three of the 240 hand-read posts, all in Botnet Log, carried a corporate flag. The flag has a precision of only 0.33 to 0.67, so these are examples and not a rate. Access sales proper belong to the initial access chapter.
Sort Alerts by Product Before Choosing a Response
A feed item saying “botnet logs mention your brand” does not say which product it is. The evidence says to ask that first, because the responses differ. In our sample about a quarter of Botnet Log posts are bank listings, a job for the fraud team, and a fifth are game lots, rarely yours to fix. Strict stealer clouds are a minority, a weighted 6.3%, but they are the form that most clearly points to an infected machine.
Three routines follow. Send cookie and session material to identity operations, with revocation as the action; the account takeover lifecycle shows where that fits. Send bank listings to fraud, with payee and device controls. For combolist mentions, reset and test for reuse first, and escalate to endpoint work if the material matches live session data or claims a recent capture.
Raw counts cannot tell you which of these you face. A dark web monitoring workflow earns its value when it records the form of each item, and the corporate impact of credential stuffing explains why the reuse check matters.
Method and Scope
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
Scope: posts collected from 1 January to 27 October 2026, by post time, from a collection dominated by Telegram with limited forum coverage. Counts are collected posts, not offers, sellers, victims or transactions. Prices are advertised terms and were not tested. Records are selected examples, not a sample.
Read the full methodology or the Stolen accounts research hub. Companion pieces cover why a credential list subscription gets cheaper by the day and fresh, private and valid claims.
