The GA-154.116.35.24 Log Means Your Logins Are Now Exposed

88 Accounts Exposed in the GA-154.116.35.24 Stealer Log

HEROIC analysts identified a stealer log timestamped 19.07.2026 16-51-02 and tagged to the IP address 154.116.35.24, uploaded by a Telegram user the same day. The file holds 88 records, each pairing an email address with a plaintext password and the URL of the login it belongs to.

Why This Is Dangerous

Because this data was harvested straight from an infected device, the passwords inside are ones people were actively using at the time of infection, not old, already-reset credentials. Each entry comes pre-matched to the exact website it unlocks, meaning anyone with the file can attempt to log in right away.

What Was Exposed in This Log

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters

Even at 88 records, this log gives attackers working email and password pairs they can test against other sites through credential stuffing. Anyone in this log who reused their password on another account is at risk of that account being taken over, drained, or used to commit fraud in their name.

How This Stealer Log Was Likely Created

Infostealer malware infects a device, then quietly collects saved browser passwords and active login sessions before sending everything back to the attacker as a single file. The IP address and timestamp in this log's filename likely mark the infected machine and the moment the data was captured, before it was uploaded to a Telegram channel.

Check If You Are Affected

If your email might be among the 88 records in this leak, HEROIC's free breach scanner checks it against a database of more than 400 billion exposed records. Run a free scan today and change any password you may have reused.