Search Your Email: CLOUDHEAVENLOGS A-Country Exposed 4,574 Accounts

On June 7, 2023, a Telegram user uploaded a geo-segmented infostealer log bundle labeled "A COUNTRY - 304PCS - CLOUDHEAVENLOGS" containing 4,574 compromised records. The CLOUDHEAVENLOGS operation sorts stolen credentials by geographic region, selling batches filtered by country of origin to buyers who want to target specific regional services. This bundle contained 304 individual log files from the same geographoc zone, compiled into a single upload. HEROIC's DarkHive monitoring system detected, captured, and indexed this file on the date of distribution -- every one of the 4,574 records is in our database. Search your email now to see if you are in it.

Why This Is Dangerous

Geographic filtering makes stolen credentials significantly more dangerous for regional victims. Attackers who purchase an A-Country pack from CLOUDHEAVENLOGS are specifically targeting users in that region -- their banking portals, local e-commerce platforms, government services, and regional email providers. The 4,574 people in this pack are not random targets in a global dump; they are pre-selected by geography, making them the precise focus of whatever regional attacks the buyers are running. Credentials from geo-sorted packs are typically weaponized faster because buyers already know which services to test.

What Was Exposed

• Email Addresses: 4,574 email addresses from devices infected in the targeted geographic region
• Plaintext Passwords: Unencrypted passwords extracted directly from browser credential stores on compromised machines
• URLs: The specific login pages and services where each email/password pair was harvested by the infostealer, giving attackers a ready-made target list for regional attacks

Why This Matters

The CLOUDHEAVENLOGS naming convention -- "A COUNTRY," "B COUNTRY," "C COUNTRY" -- reveals a delibarate geographic sorting strategy applied to a large stolen credential inventory. The 304-file A-Country batch is one slice of what is likely a much larger categorized archive covering multiple regions. Professional operations like CLOUDHEAVENLOGS aggregate logs from infostealer malware campaigns and reorganize the output by geographic identifiers, making each batch more valueable to regional attackers than an unsorted global dump. This level of organization signals a sustained, professional operation.

How Stealer Log Operations Work

CLOUDHEAVENLOGS aggregates stolen log files from infostealer malware campaigns and reorganizes the output by geographic identifiers, likely based on IP addresses or locale settings of infected devices. Infostealers like RedLine, Vidar, and Raccoon report device metadata alongside stolen credentials, enabling operators to sort logs by country. CLOUDHEAVENLOGS packages these sorted batches for distribution on Telegram, either as free drops to build channel followers or as paid offerings to buyers seeking regional targeting capabilities. Each infected device contributes a log file that feeds the operator's geographic sorting pipeline.

Check If You Are Affected

HEROIC's free breach scanner covers more than 400 billion exposed records, including the CLOUDHEAVENLOGS A-Country 304PCS upload and related geographic batch distributions from this operator. Enter your email address now to instantly check if your credentials appear in this or any other indexed breach in our database. 4,574 accounts were geo-targeted by this operation -- search your email and find out if yours is one of them.