Singapore Server SG119.56.98.181 Leaks 189 Credentials on Telegram

HEROIC analysts found a stealer log connected to the exposed server SG119.56.98.181, a Singapore-based IP address, posted to a public Telegram channel on March 10, 2025. The log contained 189 records, each including an email address, a plaintext password, and an API host URL harvested from a compromised endpoint. The Singapore origin of the server is notable because it places this breach within a region that serves as a major technology and finance hub for Southeast Asia, meaning the affected credentials may grant access to regional platforms and services with wide reach across multiple countries.

Why This Is Dangerous

With 189 plaintext passwords now publicly available on Telegram, anyone who downloaded this log has an immediate toolkit for account takeover. There is no decryption required, no brute forcing, and no guesswork. The API host URLs bundled with each record make this even more concernng because they identify exactly which platforms and services the malware targeted. Attackers operating anywhere in the world can use these credentials to access systems that may be hosted in Singapore or serve users across the Asia-Pacific region.

What Was Exposed

• Email Addresses
• Plaintext Passwords
• URLs (API host endpoints)

Why This Matters

The 189 people whose credentials appeared in the SG119.56.98.181 stealer log are immediately vulnerable to account takeover, credential stuffing, and identity theft. Because Singapore serves as the regional headquarters for many multinational companies and financial institutions, breached API credentials from this server could expose corporate systems, not just personal accounts. Attackers who gain access to a business email account can impersonate employees, initiate fraudulent transactions, or move lateraly into internal networks, causing harm far beyond the original 189 records.

How Stealer Logs Work

Infostealer malware is built to harvest credentials without detection. It typically arrives through a phishing email, a fake software update, or a malicious file download. Once active on a device, it scans for saved browser passwords, session tokens, and application credentails, packaging everything into a structured log file. That file is then transmitted to the attacker's server and redistributed on Telegram channels and dark web forums. The infected user usually has no idea any of this happened until their accounts start behaving strangely or they find their email in a breach report.

Check If You Are Affected

If you use services hosted in Singapore or the Asia-Pacific region and are concerned about the SG119.56.98.181 stealer log, HEROIC's free breach scanner can check your email address against more than 400 billion exposed records in seconds. Visit heroic.com/breach-scanner now to find out if your credentials were caught in this breach or any of the thousands of others we track around the world.