The 181.66.195.154 Telegram Stealer Log Had More Stolen Passwords Than Most People Have Contacts

HEROIC analysts identified a stealer log uploaded to Telegram in June 2023 from the IP address 181.66.195.154, catalogued as breach 272529_PE. The file contained 30 records with email addresses, plaintext passwords, and URLs. The breach was verified and added to the HEROIC DarkHive database on June 25, 2023.

Why the 181.66.195.154 Stealer Log Is Dangerous

This log contains plaintext passwords, which means there is no hashing or encryption standing between an attacker and the accounts listed. Each record pairs an email address with its password and the URL of the associated service, giving attackers everything needed for immediate, targeted login attempts on real accounts.

What Was Exposed in the 181.66.195.154 Stealer Log

• Email Addresses
• Plaintext Passwords
• URLs

Why This Matters

Stealer log credentials fuel credential stuffing attacks at scale. Thirty compromised records can become hundreds of compromised accounts if those passwords are reused across services. Victims face risks including unauthorized access to financial accounts, social media hijacking, identity theft, and the broader exposure of personal data held in linked services.

How Stealer Log Breaches Like 181.66.195.154 Work

Stealer malware is installed on a victim's device through phishing attacks, fake software, or malicious ads. Once running, it harvests saved browser credentials, active session cookies, and the URLs where those credentials are stored. The attacker receives a packaged log file, which is then shared through Telegram groups or sold on dark web markets to other criminals.

Check If You Are Affected

HEROIC's free breach scanner searches more than 400 billion breach records, covering stealer logs, database dumps, and combolists. If your email or password appeared in the 181.66.195.154 log or any other known breach, you will find out right away. Visit HEROIC for your free check.