Overview of the german afd email leak

news

The mail boxes cover really various windows: Gauland

‘s runs 2017– 2023,
bundesgeschaeftsstelle@ drop in early 2018, and the hyphenated Holm folder covers simply 2 weeks( A6 ). The 2016– 2018 peak is mainly the bundesschiedsgericht@ folder, which holds much more than the arbitration court’s mail (A2). An empty cell suggests the archive has no e-mails from that folder for that year.

A2 · Why DATA.md has 2 e-mail tables with extremely various numbersdocs/DATA.md programs one table per mail box ( e.g. bundesschiedsgericht@ holds 101,078 e-mails) and one per address (that exact same address “received” just 8,800). Both are proper. They respond to various concerns:

They would just match if every e-mail in a folder were noticeably from or to that folder’s name. That isn’t real. An e-mail can reach a mail box through Bcc, a subscriber list, an alias or a forwarding guidelineso the name is never ever composed in the header. And a folder can hold other individuals’s mail outright. The getting mail server records the real recipient in a Delivered-To header, which reveals what took place:

3 folders reveal the impact plainly:

• Gauland: 32,615 e-mails kept. His address remains in To/Cc just 13,167 times( DATA.md’s “received” figure, 14,482, includes discusses in other folders ). The server tape-recorded him as the genuine recipient on 32,600( 100% ). The majority of his mail reached him as Bcc, by means of lists or aliases. And he sent out just 15 of them: this is an inbox, not a sent out folder.
• bundesschiedsgericht@ ( federal arbitration court): 101,078 e-mails, however just 14,311( 14%) include that address in any header. The folder is mainly other individuals’s mail: the Sankey listed below programs Alice Weidel’s,
  paypal@Magnus Heutmann’s and others. The folder name states where the source submitted the mail, not whose mail box it was.
• leif.erik.holm@ (dotted): 60,215 e-mails, and the dotted address appears in
  none of them (0 ). It is the mail of leif-erik.holm@ (hyphen), the MV celebration workplace [email protected]journalism workplace and others.

Guideline: for “how much mail is in this folder” utilize the per-mailbox table. For
“how much did person X write or receive” utilize the address, preferably with the shipment headers, and keep in mind that an individual can have a number of addresses (Jacobi has 3).

Green links: provided to the folder’s own name. Violet: provided to another personGrey: no shipment header (the server didn’t tape-record one) or smaller sized receivers folded into otherHover a link for its count.

A3 · How lots of e-mail threads?A thread here is a set of e-mails connected through the Message-IDs they mention in their
In-Reply-To/References headers (threads/ in the corpus; no subject matching). The heading number depends upon what you call a thread:

• 300,807 threads if every unanswered e-mail counts as its own thread.
• 49,554 discussions if a thread requires a minimum of 2 e-mails. These hold 169,925 e-mails (40% of all).

84% of threads are a single e-mail: newsletters, notices, spam, one-off messages no one addressed, or responds whose predecessor isn’t in the archive.2 indications that the mail boxes are insufficient: 63,718 threads (21% )point out a minimum of one earlier e-mail that is not in the archive ( 98,919 missing out on e-mails in overall, e.g. the sent out copy of a reply). And just 9,111 threads cover more than one mail box folder, partially since of the Message-ID deduplication( A1).

A4 · Who sends out the e-mails? Spam, political leaders, AfD, business, personal individualsEach e-mail gets one classification from its sender address. The guidelines are easy and used in order (very first match wins). They reside in src/analysis/senders.py:

These are declarations about the addressnot confirmed identities. An AfD MP composing from
@bundestag.de counts under Politics & & stateone composing from gmail under Personal individuals

Brief response: about half of all e-mail is AfD talking ( 53%): celebration workplaces, authorities and celebration systems, from just 2,785 addresses.
Personal individuals followed( 18%), from without a doubt the most addresses( 17,247), followed by business (15%; printers, merch providers, IT, legal representatives, associations) and[19459720&]automatic mail
(10%; PayPal alone sends out 22,000). Politics & state outside the AfD domains is little (2%; primarily @bundestag.de. Spam
is 8,618 e-mails( 2%), however from nearly as numerous unique addresses, the normal signature of spam.

Spam: the server’s flag vs. these guidelinesYes, there is a spam flag from the

AfD and politics & & state: who precisely?Left (blue): the AfD. 221,769 e-mails originated from celebration addresses, topped 428 domains (the part of an address after the @) and 2,785 addresses. The chart reveals the 10 domains that sent out the most e-mails. Each bar is one domain. Its length and the number at its end offer the number of e-mails from addresses at that domain remain in the 10 mail boxes. Together these 10 domains represent 85% of all AfD e-mails.
(orange): politics & & stateimplying parliaments, other celebrations, federal government, courts and authorities (8,770 e-mails), divided by sort of sender. Here too, the number at each bar is the variety of e-mails.Bundestag mail( 7,068 e-mails from 155 addresses) is focused: 90% originates from 15 addresses, which come from markus.frohnmaier leif-erik.holm beatrix.vonstorch enrico.komning alice.weidel michael.espendiller anton.friesen and their personnel (.maNN. These are AfD MPs, so the majority of Politics & state remains in reality AfD individuals composing from parliament accounts. Other celebrations hardly look like senders.

Each bar divides a classification’s sender addresses by the number of e-mails every one sent out. Personal individuals are mainly one-off authors: 13,199 of 17,247 personal addresses( 77 %) composed precisely as soon as, members of the general public composing to the celebration. AfD addresses are couple of however respected. Spam is practically completely 1 e-mail: a brand-new address whenever.

A5 · What does it appear like as a network?Every address is a node. An edge goes from a sender to each address in To/Cc/Bcc, weighted by the variety of e-mails.

Brief response: a couple of centers and a big fringe. 86% of addresses hang together in one cluster, held together by a handful of celebration addresses that send by mail hundreds or countless others. The majority of edges are one-directional: just 13% of sender → recipient sets ever composed back. The other 5,087 little clusters are mainly separated sets (4,415 of them): one outdoors address and one recipient that never ever link to anybody else.

Check out a row as this type of sendera column as composes to this sort of recipientA shipment is one (e-mail, recipient) set, so one e-mail to 100 receivers counts 100 timesThat makes mass mailers loom big:

• AfD → AfD is the most significant block: internal mail and celebration subscriber list.
• Personal individuals → Politics looks huge( 10% ), however it is pumped up by individuals sending by mail entire parliaments: the 10 busiest personal senders represent 34 % of it, and 25 % of all shipments by personal senders.
• The exact same opts for Business → Companies: the biggest single sender in the archive, musik-baron.desent out ~ 1,900 e-mails to ~ 100 receivers each (celebration addresses, MPs, media).

A two-way contact is the easiest indication of a genuine correspondence. Just a minority of personal individuals and business ever got a reply in the archive. (Replies sent out from addresses or mail boxes outside the archive are unnoticeable here, so this is a lower bound. )

2 clusters control. On one side NRW (state workplace, arbitration court, Jacobi’s 3 addresses, the state board ), connected to the MV workplace (7, 16) and the fan store (5, 6). On the other, the federal celebration around Gauland and Weidel (17, 11), surrounded by personal and business mass mailers who compose to them and to MPs of all celebrations (the big green dot, no. 1, is one such sender). Disappointed: PayPal’s notices to [email protected]which form a different island. Personal individuals are not called: they are noted by their mail service provider just, and those composing from their own domain as own domainwithout it (the sender guidelines count such domains as business; here they are revealed as personal individuals). The point is the structure, not determining people.

A6 · Weird structuresThings in the e-mail information that are not what they appear like:

1. 2 Holm mail boxes, and the larger one never ever names its name. The dotted
   [email protected] folder holds 60,215 e-mails from 2019 to 2026, however that spelling appears in no header of any e-mail in the archive. The genuine address is the hyphenated
   leif-erik.holm@whose own folder holds simply 247 e-mails from 25 Dec 2022 to 9 Jan 2023, covering 2 weeks. The source’s instruction lists just the hyphenated address.
2. Folders called after one address hold others’ mail. bundesschiedsgericht@ is mainly Alice Weidel’s, paypal@‘s and Magnus Heutmann’s mail (A2). A folder name states where the source submitted the mail, not whose inbox it was.
3. unknown/ isn’t unidentified. Its 7,237 e-mails have no folder owner, however where a shipment header exists it names genuine accounts: [email protected] (1,147), [email protected] (342 ), [email protected] (245 ).
4. Inboxes vs. sent out mail vary per folder. The name sent out 0% of the e-mails in alexander.gauland@ 68% in bundesgeschaeftsstelle@Gauland’s folder is an inbox (15 sent out e-mails in 6 years). Concerns like “how often did X reply” can just be responded to where sent out mail remains in the archive.
5. sebastian.lux@ efficiently drops in 2021. 31,817 of its 32,020 e-mails are from before 2022, then just 203 drip in till 2026.
6. Shipment headers depend upon the server, not the individual. From 0% of e-mails (sebastian.lux@to 100% (leif-erik.holm@. Where they’re missing out on, Bcc and list receivers are undetectable.
7. Mass mail. 31,750 e-mails have the precise very same text as another e-mail (newsletters, notices, mailings sent out one recipient at a time), though each has its own Message-ID.
8. Addresses that never ever send out or get. 14,774 of the 93,635 addresses appear just
   in a Reply-To header, normally web kinds and newsletters (“reply to this person, not to me”. This is why DATA.md counts 93,635 addresses in general, however just 78,861 as senders or receivers.

A7 · How total and how genuine are the e-mails?2 look at the quality of the information. : how lots of e-mails have no legible text? 2nd: are the e-mails still precisely as they were sent out? For numerous e-mails this can be inspected through their DKIM signature (described even more down). The DKIM results originated from
uv run verify-dkim (see REPRODUCE.md).

4,283 e-mails (1.0%) have no legible text. The majority of them are not broken: 3,513 consist just of accessories( a PDF, a scan, a calendar invite), 281 are automated read invoices, and in 230 Outlook loaded the text into a
winmail.dat accessory. 132 have an HTML part with no text( usually a newsletter made from images), 67 are encrypted, and just 60 are totally empty.
No folder sticks out: the share lies in between 0.2% and 2.0% (schiedsgericht@. These e-mails still count in every number that is based upon headers.

What is DKIM? A digital signature that the sender’s mail server connects to an e-mail when sending it; if the text or among the signed headers (such as sender, subject or date) is altered later on, the signature no longer matches.100,929 e-mails( 24%) bring a DKIM signature. The share differs by year, from 11%( 2018) to 44%( 2026). (56 e-mails might not be parsed by the verifier; they count as anonymous.)
What the signatures state today:

• 27,120 validate totally: text, headers and the sender’s secret, which is still released.
• 7,628 are mathematically undamagedhowever ended or made with the out-of-date SHA-1.
• 20,993 have a the same texthowever the sender’s domain no longer releases the secret, so the header part can’t be examined. That is typical for old mail: secrets get changed.
• 11,204 have a the same text, however the header check stops working. Either a header line was altered en route( mail entrances tag topics, for instance), or the domain has actually because released a brand-new secret under the exact same name.
• 33,805 have a text that no longer matches what the sender signed. This check requires no secret, so it is dependable for old mail too.

A damaged seal does not show a forgery. An undamaged one states just that the text is what the sending out server signed, not that it holds true.

Modified e-mails? The altered texts are a technical pattern, not private edits.
31,690 of the 33,805 e-mails with an altered text( 94 %) remain in one folder,
bundesschiedsgericht@There, 92% of all signed e-mails from Feb 2015 to 17 September 2019 are impacted, from every sort of sender( PayPal invoices, Gmail, Twitter …). It stops from one day to the next: of the 1,397 signed e-mails after that date, 1 is impacted. The folder’s volume drops greatly at the very same time. In all other folders, 3.3 % of the signed e-mails have an altered text, without any equivalent cluster.
Hand edits would strike a couple of picked e-mails, not nearly every PayPal invoice of a month. The pattern fits software application that re-encoded the kept e-mails, for instance when the mail box was relocated to another system. A different check of 200 altered and 200 undamaged e-mails from this folder (not run in this note pad) supports that: 171 of the altered ones consist of base64 obstructs covered evenly at 76 characters, versus 85 of the undamaged ones. In the very same check, added or prepended text, line endings and mbox >From estimating described none of the modifications.

Part B: the site informationB0 · Where does it originate from, and did the sites result in the mail?2 accounts can be examined versus each other here: the archive itself, and the restoration by Lilith Wittmann and Hoodinformatik (“Zweimal gehackt”20 October 2026), which rests on declarations from the hackers and from individuals near to the hosting supplier.
What the short article states occurred: an insecure WordPress website, wahlkampf.afd.dewas the method. A plugin (WP-Console) provided a command line on the server, from there the method led into the mail administration; the passwords of celebration authorities’ mail boxes were altered and the mail downloaded over IMAP. A very first run was discovered on 9 September (about 180 GB), a 2nd one on 14 September was stopped around 6 a.m. after about 300 GB in all. The systems come from Alternita Dienstleistungs GmbHthe celebration’s own service business, which runs hosting for lots of state and regional associations.
What the archive reveals for itself: 04_TABULAR_DATA/000428_raw_console.jsonl is a log of 201 shell commands from 12 September, run with the rights of the wahlkampf.afd.de site, inside that website’s folderThe commands and their output include working passwords and API secrets, so the note pad just reveals when each command ran and what sort of action it was (check out off the command, see analysis/access.py.

Check out from the outputs of the very same log:

• Passwords from the web server. The setup files of every website on the maker read, consisting of database passwords.
• The mail-management system responses. The internal app behind mail-management.afd.de reads from disk; with an essential discovered there, its API initially declines( HTTP 401), then returns information( HTTP 200). Around 16:30 a list of all mail users ( ≈ 0.9 MB) is downloaded and developed into a mail box table. The archive’s mailbox-management table(000678_mm_mailboxes.tsvis the very same sort of record.
• Mail-server logins work for a system account(no-reply@…on 3 mail hosts.
• The direct path stops working. For 2 hours there are efforts to install the mail storage (NFS_…_MAIL_BACKENDfrom the web server; every effort is declined.
• Not noticeable in this log: the WP-Console plugin (it is likewise not amongst the website’s active plugins in its exported settings), and the altering of mail box passwords. Both might have occurred outside this one session, which covers just 201 commands on one afternoon.

A 2nd record cross-checks the post’s hour. The archive likewise holds the mail box table of the mail-management system(000678_mm_mailboxes.tsv2,219 mail boxes; the password column is not checked out here). It reveals 6 brand-new mail boxes on 14 September in between 04:24 and 04:27 UTC (06:24– 06:27 German time ), each kept in mind as “Backup-Account von …@afd.nrw”Among them is the backup of
[email protected]whose mail box remains in the archive. The table does not state who produced them, or why. The timing fits the post’s “detected around 6 a.m.”The table’s most recent modification is from 08:47 UTC that early morning, so this copy was made after the detection.
Password modifications, examined: 9 of the dripped mail box folders appear in this table( the dotted leif.erik.holm@ does not: it is no mail box of its own, which fits A2). Just 1 of them altered in September 2026 ([email protected] at 05:24 UTC on 14 Sep), after the detection. The table keeps just the current modification per mail box, so previously modifications might be overwritten, however for the unblemished ones there is
no indication of a password modification through this systemIf passwords were altered, it took place someplace this table does not record.

How short article and archive mesh:

Beyond the mail, the source’s work submits record additional site gain access to: database logins with qualifications from website setup files (wp-configand backups, and a self-made single-sign-on token that, by their own record, offered admin gain access to on afd-fraktion-hessen. de (000264_SERVER_ACCESS_LEDGER.tsv. wahlkampf.afd.de and alternita.de are both amongst the exported websites; Alternita likewise looks like the operator of an order system (bestellung.alternita.deand as admin accounts called alternita_* on celebration websites.

B1 · How numerous sites dripped, and which domains?Brief response: 139 sites: www.afd.de plus 138 other party-related websites.
How that number happens, due to the fact that it varies from the “140” in DATA.md:

• 04_TABULAR_DATA/ holds table exports under 142 various export names.
• Among them (h4_route_samplesisn’t a site (output of among the source’s tools).
• One (afd_deis a later on copy of www.afd.dewhose primary database remains in 02_DATABASES/
• That leaves 140 export names (DATA.md’s “140 other websites”. Each website’s own
  siteurl setting reveals that 2 sets are the exact same website: afd-dessau-rosslau_de afd_dessau_rosslau_de ruben-rupp_de test-micro_afd_de
  (afd-dessau-rosslau. de, ruben-rupp. de). test-micro.afd.de is a staging copy of ruben-rupp.deThere are 138 unique domainsplus www.afd.de

Every domain listed below reads from the website’s own database (siteurl setting), not thought from the file name. The website types are this note pad’s own grouping, check out off the domain.

All 139 dripped sites ( one row per unique domain, organized by website type; counts stand out records in the dripped database, as in B2 ). Scroll the list; links open the live website.