Stolen Accounts, Botnet Logs and Combolists: The Report
We hand-read 160 Botnet Log posts and 80 Combolist posts. The labels do not name one product: under Botnet Log, bank-account listings (23.8%) and game-account lots (21.3%) outnumber strict stealer-log clouds (6.3%), all weighted estimates.
- 23.8%
- Bank-account listings under the Botnet Log labelA weighted share of 160 hand-read posts. They outnumber strict stealer-log clouds (a weighted 6.3%; 9 of the 160, or 5.6%, unweighted).
- 144 of 174
- Eligible ladder segments where the per-day price fallsCredential lists are sold by time: the computed per-day price falls at every step as the plan gets longer.
- 115,032
- Estimated cleaned Combolist-class postsAbout 115,032, beside about 66,979 Botnet Log-class posts, 1 January to 27 October 2026. Collected posts, not offers or sellers.
Brandefense / Cybercrime Report 2026 / Stolen Accounts Stolen Accounts, Botnet Logs and Combolists 1 January to 27 October 2026. Dataset v1.0. Collected posts, not a market total. Get The Stolen Credentials Report.
Read the report, open the evidence records and reuse the charts with their source and limits.
Edition 1.0 · 1 January–27 October 2026 · Free access · 30 October 2026 · Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Four Investigations. Accounts, Dumps And Buying Instructions.
What do posts labelled stolen accounts, botnet logs and combolists actually offer, what do their prices measure, and how often does the same text come back? Four investigations of collected Blackhole posts, 1 January to 27 October 2026.
Units: shares of hand-read collected posts and advertised prices as written. They are not sellers, sales or exposure.
The full-year PDF edition follows in early 2027. The accessible edition carries the same text, figures and limits as one HTML page for screen readers, zoom and copying text.
- 01 What "Botnet Log" and "Combolist" Posts Actually Sell Hand-read posts under the botnet logs and combolists labels hold bank listings, game lots, rate sheets and subscriptions. Each needs a different defence. Read online →
- 02 Account Buyer Rate Sheets: What They Ask Suppliers For Account buyer rate sheets require 2FA secrets, cookies and friend counts. Rate pairs differ; the secret column suggests supplier enrolment. Read online →
- 03 Why a Credential List Subscription Gets Cheaper by the Day In 144 of 174 eligible credential-list ladder segments, the per-day price falls at every step. Read online →
- 04 Fresh, Private, Valid: How Combolist Claims Differ in Reposted Text Reposted combolist claims say fresh, private and valid about twice as often as texts not seen twice. Read online →
- 05 Method, limits and the evidence catalogue. A post is not an incident, and an ad does not prove a sale or show that a tool works.
Inspect The Evidence Behind The Report.
Reuse our charts with their source, dates and limits.
Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.
AI disclosureBrandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
- 01Counts are collected posts in a Telegram-dominated collection, not offers, sellers, victims or a market total.
- 02Telegram dominates the collection; forum coverage is small (forum share of kept posts by month shown in observed-records.csv).
- 03Class labels changed around May-July 2026. No trend across that window is claimed. October ends on 27 October.
- 04Prices are advertised terms; units differ by product form and are never pooled, averaged or converted.
- 05Shared text across posts does not show common ownership; claim words (fresh, private, valid) are seller wording, not tested properties.
From Research To Monitoring.
See when your company's passwords, data or name show up on criminal forums and markets.
See how it worksCheck Your Domain.
Free exposure check. Enter your company domain and see what is visible from the outside, in about 30 seconds.
The Other Seven Chapters.
The Cybercrime Report 2026 reads eight kinds of activity in the same collection. Each chapter counts its own unit, so compare their limits before you compare their numbers.