Godaddy_SMTPs uploaded by a Telegram User: A Small Stealer Log Leak

In February 2026, HEROIC analysts found a stealer log labeled Godaddy_SMTPs, uploaded to a Telegram channel by an unnamed user. The file is a small one, containing 55 records, each pairing an email address with a plaintext password and the URL of the SMTP or login service it connects to. As the name implies, this collection appears to be focused on GoDaddy-linked email sending credentials rather than a general password dump.

Why This Is Dangerous

SMTP credentials are used to send email through a mail server, which means a working set of these logins can let an attacker send messages that appear to come from a legitimate domain. With 55 plaintext password and URL pairs in this file, an attacker has everything needed to log in and start sending mail without any additional work.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs for the associated login or SMTP services

Why This Matters

If an SMTP account like the ones in this file falls into the wrong hands, it can be used to send phishing emails or spam that look like they come from a trusted source, damaging that sender's reputation and putting their contacts at risk. If any of these 55 passwords are reused on other accounts, credential stuffing against banking, shopping, or personal email is also a real possibility.

How Stealer Logs Work

Stealer logs are produced by infostealer malware, software that infects a device through cracked programs, fake updates, or malicious attachments, then quietly collects saved credentials from email clients, browsers, and other applications. That data is sent back to whoever controls the malware, and specialized subsets, like SMTP logins, are often separated out and shared as smaller, focused files exactly like this one.

Check If You Are Affected

If you manage email through GoDaddy or a similar hosting provider, it is worth checking whether your credentials appear in this file. HEROIC's free breach scanner searches a database of more than 400 billion breached records, including small stealer logs like this one, so you can find out quickly and update your password if needed.