Dark Web Intel: 46K Credentials From the DmitriyPremium Log Dump

In June 2025, a threat actor operating under the alias DmitriyPremium distributed a stealer log archive containing 46,127 records through a Telegram channel as a free sample. The dataset included plaintext passwords, email addresses, and the URLs of the services where each credential was captured. This type of free distribution is a common tactic in underground credential markets, where threat actors release a portion of their data to demonstrate quality and attract buyers for larger, premium datasets.

Why This Data Dump Is Dangerous

The DmitriyPremium logs represent a curated collection of stolen credentials that have been verified and packaged for easy consumption. With 46,127 records containing plaintext passwords, every single entry is immediately usable without any additonal processing. The free distribution model means this data has been downloaded by an unknown number of threat actors, each of whom can independently launch credential stuffing attacks, account takeovers, and identity theft campaigns. The inclusion of URLs alongside each credential pair eliminates the guesswork for attackers, pointing them directly to the login pages where these stolen passwords will work.

What Was Exposed in the DmitriyPremium Logs

• Email Addresses: 46,127 unique email addresses harvested from compromised machines, covering personal email providers, corporate domains, and cloud service accounts
• Plaintext Passwords: Fully unencrypted passwords extracted from browser password managers, requiring zero effort to exploit
• URLs: The exact websites and login portals tied to each credential set, providing attackers with a direct path to account compromise

Why This Matters

Free stealer log distributions like the DmitriyPremium dump serve as the entry point for a much larger underground economy. The 46,127 records released for free are likely just a fraction of the total data this actor controls. Buyers who verify the quality of the free sample will then purchase access to premium datasets containing hundreds of thousands or even millions of additional records. For the individuals whose credentials appear in this free sample, the exposure is immediate and the risk is compounded by the fact that their data is being used as a marketing tool to fuel further cybercriminal activity.

How Stealer Log Markets Operate on Telegram

Telegram has become the prefered marketplace for stealer log distribution due to its accessibility and the difficulty of monitoring private channels at scale. Threat actors like DmitriyPremium operate dedicated channels where they post free samples, advertise premium log bundles, and negotiate bulk purchases. The logs themselves are generated by infostealer malware deployed through phishing campaigns, trojanized software, and malvertising. Once collected, the raw data is cleaned, deduplicated, and organized by country, service, or credential type before being packaged for sale. The free logs represent the bottom tier of this supply chain, designed to build trust and drive sales of higher-value datasets.

How Premium Stealer Log Channels Work

The naming convention DmitriyPremium signals that this actor operates a tiered distribution model. Free log releases attract subscribers and demonstrate data quality, while the premium tier offers fresher, larger, and more targeted credential sets for paying customers. These premium channels often charge subscription fees or per-log pricing, with fresher logs commanding higher prices because the credentials are more likely to still be active. The busness model mirrors legitimate software-as-a-service platforms, complete with customer support, sample previews, and satisfaction guarantees, all built on stolen personal data.

Check If You Are Affected

The DmitriyPremium stealer log dataset has been indexed in the HEROIC data breach scanner, which monitors over 400 billion compromised records from dark web sources, stealer logs, and data breaches worldwide. If your email address or credentials were included in this Telegram distribution, our scanner will identify the exposure. Search your email now to determine whether your accounts are at risk and take immediate steps to rotate your passwords and enable multi-factor authentication.