Account Buyer Rate Sheets: What They Ask Suppliers For
Account buyer rate sheets treat a 2FA secret, a cookie and friend count as deliverables. Same-sheet pairs show which of them moves the stated rate.
Read the investigation →
Brandefense Cybercrime Report 2026 · Stolen Accounts & Combolists
1 January–27 October 2026 · Research edition 1.0
What The Credential Labels Really Sell.
We hand-read 160 Botnet Log posts and 80 Combolist posts. The labels do not name one product: under Botnet Log, bank-account listings (23.8%) and game-account lots (21.3%) outnumber strict stealer-log clouds (6.3%), all weighted estimates. Counts are collected posts in a Telegram-dominated collection, not offers, sellers, victims or a market total.
Hand-read Botnet Log posts 6.3%
of hand-read Botnet Log posts are strict stealer-log clouds (weighted estimate) Collected posts, not incidents or market totalsAdvertised terms, not tested services What this number measures →
01Key findings
Accounts, Dumps And Buying Instructions
Each finding below is stated in its own unit, with the limit that comes with it. The investigations give the full reasoning and the evidence records.
What the label holds · n = 160
Weighted share of postsWhat a "Botnet Log" label holds.
Hand-read kept posts, n = 160. Weighted share of posts with 95% interval.
Bank-account listings and requests 23.8%
Game-account lots 21.3%
Buy-side account or cookie submissions 17.0%
Not an offer (replies, chatter, notices) 11.3%
Stealer-log clouds for sale or access (strict) 6.3%
Tools, bots and service menus 4.8%
Credential files, samples and pointers 4.6%
Other accounts and cookies for sale 4.4%
"Log" posts with no identifiable product 3.1%
Wanted posts for logs or credential files 2.3%
Promotions and notices of such clouds 1.2%
Post type under the labelStrict stealer-log clouds
Clouds: strict 6.3% (2.6-10.4); broad reading, adding promotions and relayed notices, 7.4% (3.5-12.1); first label, unaudited, 12.0% (7.2-17.4).Game-account lots are a moderate-confidence reading. Combolist label (n = 80): see composition.csv.
Source: Brandefense Blackhole, posts dated 1 Jan-27 Oct 2026. Hand labels by one AI labeller, blind to the classifier; sampling interval only. Collected posts, not offers or sellers.
Chart dataCSV · 4.8 KBOriginal chartSVG · 101.2 KB
+View as table
| Post type | Weighted share | 95% interval | Posts labelled |
|---|---|---|---|
| Bank-account listings and requests | 23.8% | 17.1–31.1% | 36 |
| Game-account lots | 21.3% | 15.1–28.0% | 30 |
| Buy-side account or cookie submissions | 17.0% | 11.1–23.0% | 34 |
| Not an offer (replies, chatter, notices) | 11.3% | 6.6–16.7% | 17 |
| Stealer-log clouds for sale or access (strict) | 6.3% | 2.6–10.4% | 9 |
| Tools, bots and service menus | 4.8% | 1.5–8.9% | 7 |
| Credential files, samples and pointers | 4.6% | 1.4–8.4% | 9 |
| Other accounts and cookies for sale | 4.4% | 1.4–8.4% | 8 |
| "Log" posts with no identifiable product | 3.1% | 0.7–6.2% | 4 |
| Wanted posts for logs or credential files | 2.3% | 0.0–5.4% | 3 |
| Promotions and notices of such clouds | 1.2% | 0.0–3.1% | 3 |
- 01Under the Botnet Log label, bank-account listings and requests (23.8%), game-account lots (21.3%, moderate confidence) and buy-side rate sheets (17.0%) each outnumber strict stealer-log clouds (6.3%) in 160 hand-read posts. All are weighted estimates.
- 02Credential files and pointers are the largest group in 80 hand-read Combolist posts (36.8%, interval 25.8-47.7). Of 175 bulk-combolist asking posts in the Combolist class that state an amount, 97 state an access period and 1 a per-line price. The unit extractor is 49-74% accurate, so this is a pattern, not a count.
- 03Credential-list subscriptions get cheaper by the day. 233 distinct plan texts hold 174 eligible ladder segments with three or more core tiers. In 144 of them (83%), the computed per-day price falls at every step. The plans advertise recurring drops for a set period; the adverts do not show what is delivered or renewed.
- 04Reposted Combolist texts use claim words about twice as often. 57 distinct repeated texts say fresh 49%, private 30% and valid 32%. The 2,661 posts whose text we did not see twice say 26%, 15% and 14%. The pattern does not hold in the Botnet Log class or the keyword set, and the words are seller wording, not tested properties.
- 05Buyer rate sheets treat the second factor as a deliverable. 47.5% of 59 hand-coded rate posts require a 2FA-secret column and 57.6% a cookie column. That fits supplier-enrolled accounts better than accounts handed over as found (a reading, not a fact).
02The investigations
Four Questions. One Data Set.
Each investigation answers a different question from the same collected posts. Start with the main one, then follow the question that matters to your team.
Main investigation
What "Botnet Log" and "Combolist" Posts Actually Sell
Hand-read Botnet Log and Combolist posts hold bank listings, game lots, rate sheets and subscriptions. Strict stealer-log clouds are 6.3% of Botnet Log, a weighted estimate.
Read the investigation →Why a Credential List Subscription Gets Cheaper by the Day
Credential lists are advertised as time-limited plans, and in 144 of 174 eligible ladder segments the daily cost falls at every step. The adverts do not show what is delivered.
Read the investigation →Fresh, Private, Valid: How Combolist Claims Differ in Reposted Text
Reposted Combolist texts say fresh, private and valid about twice as often as texts not seen twice. The words track advert copying, not exposure.
Read the investigation →Cybercrime Report 2026 / Cross-chapter analysis
Who Does the Work, and Who Keeps Control?
Compare hosted services, worker accounts, access transfer and account-data requests in our cross-chapter analysis.
Explore the work and control analysis ↗03For defenders
Where Account Preparation Leaves Clues
These are implications of what the posts say, not measured control results. Each one points to a different decision.
-
Ask which product a "botnet log" mention is before you act: bank listings go to fraud, session and cookie material to identity operations, strict stealer clouds to endpoint response.
-
For a combolist mention, match your own domains and users once per distinct file, reset passwords and revoke sessions on a match. Claim words such as fresh, private and valid trigger nothing.
-
These advertised prices do not establish a risk ranking: denomination and product comparability across posts are not established. A subscription advert does not show what is delivered, so act on a verified match of your own accounts.
-
Watch enrolment and session behaviour: buyer rate sheets ask for 2FA-secret and cookie columns, which fits supplier-enrolled accounts better than accounts handed over as found.
Module
Dark Web Monitoring
See when your company's passwords, data or name show up on criminal forums and markets.
See how it works →
Free exposure check
Request a demo
Check Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
04 / From research to monitoring
From Research To Monitoring.
05Method & limits
Sampling The Labelled Account Posts
- Source
- Brandefense Blackhole.
- Period
- 1 January–27 October 2026, by post time. October is partial.
- Edition
- Research edition 1.0.
160 kept (cleaned) Blackhole posts carrying the Botnet Log class label, 1 Jan-27 Oct 2026, drawn with stratum weights (set x quarter). We labelled them from full text, blind to our classifier. Strict stealer-log clouds are priced or joinable feeds and log packs said to come from infected machines.
Weighted estimate: 6.3% (95% interval 2.6-10.4); 7.4% with unpriced promotions. Unweighted, 9 of the 160 posts (5.6%). The same sample holds bank-account listings and requests 23.8% (17.1-31.1), game-account lots 21.3% (15.1-28.0) and buy-side rate sheets 17.0% (11.1-23.0).
06Get the research
The Research. Ready To Inspect.
Read the report, open the evidence records and reuse the charts with their source and limits.
HTMLEdition 1.0 Research reportAccessible reading edition · full-year PDF in early 2027 HTML55.4 KB Evidence catalogueThe records the investigations cite HTML9.9 KB Data & definitionsUnits, fields and limits
Original aggregate tables, charts and editorial paraphrases: CC BY 4.0. Keep the source, version, date range and measurement limits with reused figures.
30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
07 / All chapters
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.
01 · Ransomware 64.7% of claims came from just 33 of 177 groups 02 · Fraud 831 of 2,448 retained financial-account posts match one narrow recruitment signature (33.9%) 03 · Data Breach & Leaks 63% of Blackhole-collected posts that mention "data breach" are news retellings, not leak posts 05 · Infostealers 97.5% of January-April raw "stealer" keyword posts carried one brand's notification template 06 · Initial Access Offers 38.2% → 4.9% Share of posts under Blackhole's "Initial Access Selling" label that were access offers: 1 Jan–31 Aug vs 12 Sep–27 Oct 2026 07 · Exploits, Tooling & AI 37 of 93 exploit seller posts using the word 0-day that were coded as unnamed-exploit claims 08 · Hacktivism & DDoS 578 distinct NoName057(16) DDoS claim events (1 Jan–27 Oct 2026), carrying 2,920 claimed target entries All eight chapters Open the Cybercrime Report 2026 Eight chapters. Eight units.