Analysts Found the 6ip.us Stealer Log With 2,454 Stolen Passwords

Analysts Find the 6ip.us Stealer Log Circulating on Telegram

On 10-Jun-2026, HEROIC analysts came across a stealer log referencing "6ip.us" after it was uploaded to a Telegram channel that trades in malware-harvested credentials. The file contains 2,454 records, each pairing an email address with a plaintext password and the URL of the login page the credentials came from. The 6ip.us name attached to the file points to a link-shortening service that shows up repeatedly across the entries, suggesting the infected devices in this batch had accounts tied to that platform.

Why This Is Dangerous

Because every password in this file is stored as plain text, no cracking or decryption is needed to use it. Anyone who obtains the log can take an email and password pair straight from the file, open the matching URL, and log in as if they were the account owner. Since these credentials were pulled directly from an infected browser, they reflect the passwords people were actively using, not old or expired ones.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each login to the exact site it belongs to, including 6ip.us

Why This Matters

A file of 2,454 working credentials is more than enough for an attacker to automate. These lists get fed into credential stuffing tools that quietly test each email and password combination against banking sites, email providers, and social media platforms. For anyone caught in this leak, the result can be a hijacked account, unauthorized charges, or a stolen identity, and the risk grows the more that password has been reused elsewhere.

How Stealer Logs Like This One Are Made

This file is the product of information-stealing malware that infected a group of computers, likely through a fake download, cracked software, or a malicious link. Once active, the malware reads saved passwords and login sessions straight out of the browser and packages them into a text file, which is then uploaded to Telegram channels like the one where HEROIC analysts found this one. Because the malware grabs everything the browser has stored, a single infection can expose logins for dozens of unrelated sites at once.

Check If You Are Affected

If your email is one of the 2,454 in this file, you won't get a warning from 6ip.us or any other site tied to your account. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including stealer logs like this one, so you know immediately if your credentials were exposed. Run a free scan today and change any passwords that turn up.