德国 AfD 邮件泄露数据集分析：421,178 封邮件与 139 个网站数据库

What's in the leak

The hexane archive contains two independent datasets from different systems. They share only the occasional email address:

• emails: ten mailboxes from the AfD's mail servers, and
• websites: the WordPress databases of www.afd.de and ~140 other party websites.

This notebook answers the questions below one at a time. Every number is computed here from the files, unless it is explicitly marked as the source's: taken from the notes of the person or group who provided the data (the source below). Where two counts of "the same thing" disagree, the notebook explains which question each one answers. Read top to bottom. Each section starts with a short answer, then the evidence.

Part A: the emails

A1 · How many emails?

emails

421,178

stored messages, all folders

conversations

49,554

threads with 2+ emails

email addresses

93,635

in any header

time span

2013–2026

Mar 2013 to Sep 2026, by send date

Short answer: 421,178 emails. Each is a distinct message: the source deduplicated the archive by Message-ID before release (their DATA_DICTIONARY.md), and that holds. Only 42 emails share a Message-ID with another one, and 81 have none. So "copies of the same email in several mailboxes" is not a factor here: when two mailboxes held the same email, only one copy survived, in one of the folders. (That matters in A2.) The latest email is dated 14 September 2026: the emails end there. The website data (Part B) reaches about three weeks further.

The mailboxes cover very different windows: Gauland's runs 2017–2023, bundesgeschaeftsstelle@ stops in early 2018, and the hyphenated Holm folder covers just two weeks (A6). The 2016–2018 peak is mostly the bundesschiedsgericht@ folder, which holds far more than the arbitration court's mail (A2). An empty cell means the archive has no emails from that folder for that year.

A2 · Why DATA.md has two email tables with very different numbers

docs/DATA.md shows one table per mailbox (e.g. bundesschiedsgericht@ holds 101,078 emails) and one per address (that same address "received" only 8,800). Both are correct. They answer different questions:

They would only match if every email in a folder were visibly from or to that folder's namesake. That isn't true. An email can reach a mailbox via Bcc, a mailing list, an alias or a forwarding rule, so the namesake is never written in the header. And a folder can hold other people's mail outright. The receiving mail server records the true recipient in a Delivered-To header, which shows what happened:

Three folders show the effect clearly:

• Gauland: 32,615 emails stored. His address is in To/Cc only 13,167 times (DATA.md's "received" figure, 14,482, adds mentions in other folders). Yet the server recorded him as the real recipient on 32,600 (100%). Most of his mail reached him as Bcc, via lists or aliases. And he sent only 15 of them: this is an inbox, not a sent folder.
• bundesschiedsgericht@ (federal arbitration court): 101,078 emails, but only 14,311 (14%) involve that address in any header. The folder is mostly other people's mail: the Sankey below shows Alice Weidel's, paypal@, Magnus Heutmann's and others. The folder name says where the source filed the mail, not whose mailbox it was.
• leif.erik.holm@ (dotted): 60,215 emails, and the dotted address appears in none of them (0). It is the mail of leif-erik.holm@ (hyphen), the MV party office buero@afd-mv.de, the press office and others.

Rule of thumb: for "how much mail is in this folder" use the per-mailbox table. For "how much did person X write or receive" use the address, ideally with the delivery headers, and remember that a person can have several addresses (Jacobi has three).

Green links: delivered to the folder's own namesake. Violet: delivered to someone else. Grey: no delivery header (the server didn't record one) or smaller recipients folded into other. Hover a link for its count.

A3 · How many email threads?

A thread here is a set of emails linked through the Message-IDs they cite in their In-Reply-To/References headers (threads/ in the corpus; no subject matching). The headline number depends on what you call a thread:

• 300,807 threads if every unanswered email counts as its own thread.
• 49,554 conversations if a thread needs at least two emails. These hold 169,925 emails (40% of all).

84% of threads are a single email: newsletters, notifications, spam, one-off messages nobody answered, or replies whose predecessor isn't in the archive.Two signs that the mailboxes are incomplete: 63,718 threads (21%) cite at least one earlier email that is not in the archive (98,919 missing emails in total, e.g. the sent copy of a reply). And only 9,111 threads span more than one mailbox folder, partly because of the Message-ID deduplication (A1).

A4 · Who sends the emails? Spam, politicians, AfD, companies, private persons

Each email gets one category from its sender address. The rules are simple and applied in order (first match wins). They live in src/analysis/senders.py:

These are statements about the address, not verified identities. An AfD MP writing from @bundestag.de counts under Politics & state, one writing from gmail under Private persons.

Short answer: about half of all email is AfD talking (53%): party offices, officials and party systems, from only 2,785 addresses. Private persons come next (18%), from by far the most addresses (17,247), followed by companies (15%; printers, merch suppliers, IT, lawyers, associations) and automated mail (10%; PayPal alone sends 22,000). Politics & state outside the AfD domains is small (2%; mostly @bundestag.de). Spam is 8,618 emails (2%), but from almost as many distinct addresses, the typical signature of spam.

Spam: the server's flag vs. these rules

Yes, there is a spam flag from the mail server (X-Spam-Flag, plus X-Spam-Score). But it can't answer "how much is spam" alone: most emails have no verdict at all, because they passed through servers that didn't add one. Where a verdict exists, it lets us check the rules above:

• 51,998 of 421,178 emails (12%) carry a server verdict: 1,227 YES, 50,771 NO. Coverage depends on the mail server: 100% for the hyphenated Holm folder, under 1% for bundesschiedsgericht@.
• With the verdict hidden, the rules still catch 815 of the 1,227 server-YES emails (66%).
• They also call 2,036 server-NO emails spam (4% of them). A random sample (below) shows these are spam the server missed, not false alarms.
• On the 369,180 emails with no verdict, the rules find 5,324 spam.

So the count of 8,618 spam emails is a conservative estimate: the server flag alone gives a floor of 1,227, and the rules miss about a third of server-flagged spam, so the true figure is likely somewhat higher. Spam doesn't distort the overall picture either way: it is ~2% of the corpus.

Random sample: server said NO, rules say spam

AfD and politics & state: who exactly?

Left (blue): the AfD. 221,769 emails come from party addresses, spread over 428 domains (the part of an address after the @) and 2,785 addresses. The chart shows the 10 domains that sent the most emails. Each bar is one domain. Its length and the number at its end give how many emails from addresses at that domain are in the ten mailboxes. Together these 10 domains account for 85% of all AfD emails. Right (orange): politics & state, meaning parliaments, other parties, government, courts and police (8,770 emails), split by kind of sender. Here too, the number at each bar is the number of emails.Bundestag mail (7,068 emails from 155 addresses) is concentrated: 90% comes from 15 addresses, which belong to markus.frohnmaier, leif-erik.holm, beatrix.vonstorch, enrico.komning, alice.weidel, michael.espendiller, anton.friesen and their staff (.maNN). These are AfD MPs, so most of Politics & state is in fact AfD people writing from parliament accounts. Other parties barely appear as senders.

Each bar splits a category's sender addresses by how many emails each one sent. Private persons are mostly one-off writers: 13,199 of 17,247 private addresses (77%) wrote exactly once, members of the public writing to the party. AfD addresses are few but prolific. Spam is almost entirely 1 email: a new address every time.

A5 · What does it look like as a network?

Every address is a node. An edge goes from a sender to each address in To/Cc/Bcc, weighted by the number of emails.

addresses that sent or received

77,610

sender → recipient pairs

294,621

in one connected cluster

86%

66,512 addresses

pairs that wrote both ways

13%

Short answer: a few hubs and a huge fringe. 86% of addresses hang together in one cluster, held together by a handful of party addresses that mail hundreds or thousands of others. Most edges are one-directional: only 13% of sender→recipient pairs ever wrote back. The other 5,087 small clusters are mostly isolated pairs (4,415 of them): one outside address and one recipient that never connect to anyone else.

Read a row as this kind of sender, a column as writes to this kind of recipient. A delivery is one (email, recipient) pair, so one email to 100 recipients counts 100 times. That makes mass mailers loom large:

• AfD → AfD is the biggest block: internal mail and party mailing lists.
• Private persons → Politics looks big (10%), but it is inflated by people mailing whole parliaments: the 10 busiest private senders account for 34% of it, and 25% of all deliveries by private senders.
• The same goes for Companies → Companies: the largest single sender in the archive, musik-baron.de, sent ~1,900 emails to ~100 recipients each (party addresses, MPs, media).

A two-way contact is the simplest sign of a real correspondence. Only a minority of private persons and companies ever got a reply in the archive. (Replies sent from addresses or mailboxes outside the archive are invisible here, so this is a lower bound.)

Two clusters dominate. On one side NRW (state office, arbitration court, Jacobi's three addresses, the state board), linked to the MV office (7, 16) and the fan shop (5, 6). On the other, the federal party around Gauland and Weidel (17, 11), surrounded by private and company mass mailers who write to them and to MPs of all parties (the large green dot, no. 1, is one such sender). Not shown: PayPal's notifications to paypal@alternativefuer.de, which form a separate island. Private persons are not named: they are listed by their mail provider only, and those writing from their own domain as own domain, without it (the sender rules count such domains as companies; here they are shown as private persons). The point is the structure, not identifying individuals.

A6 · Weird structures

Things in the email data that are not what they look like:

1. Two Holm mailboxes, and the bigger one never names its namesake. The dotted leif.erik.holm@afd-mv.de folder holds 60,215 emails from 2019 to 2026, but that spelling appears in no header of any email in the archive. The real address is the hyphenated leif-erik.holm@, whose own folder holds just 247 emails from 25 Dec 2022 to 9 Jan 2023, covering two weeks. The source's briefing lists only the hyphenated address.
2. Folders named after one address hold others' mail. bundesschiedsgericht@ is mostly Alice Weidel's, paypal@'s and Magnus Heutmann's mail (A2). A folder name says where the source filed the mail, not whose inbox it was.
3. unknown/ isn't unknown. Its 7,237 emails have no folder owner, but where a delivery header exists it names real accounts: bundesgeschaeftsstelle@alternativefuer.de (1,147), fabian.jacobi@afd.nrw (342), buero@afd-mv.de (245).
4. Inboxes vs. sent mail differ per folder. The namesake sent 0% of the emails in alexander.gauland@ but 68% in bundesgeschaeftsstelle@. Gauland's folder is an inbox (15 sent emails in six years). Questions like "how often did X reply" can only be answered where sent mail is in the archive.
5. sebastian.lux@ effectively stops in 2021. 31,817 of its 32,020 emails are from before 2022, then only 203 trickle in until 2026.
6. Delivery headers depend on the server, not the person. From 0% of emails (sebastian.lux@) to 100% (leif-erik.holm@). Where they're missing, Bcc and list recipients are invisible.
7. Mass mail. 31,750 emails have the exact same text as another email (newsletters, notifications, mailings sent one recipient at a time), though each has its own Message-ID.
8. Addresses that never send or receive. 14,774 of the 93,635 addresses appear only in a Reply-To header, typically web forms and newsletters ("reply to this person, not to me"). This is why DATA.md counts 93,635 addresses overall, but only 78,861 as senders or recipients.

A7 · How complete and how authentic are the emails?

Two checks on the quality of the data. First: how many emails have no readable text? Second: are the emails still exactly as they were sent? For many emails this can be checked through their DKIM signature (explained further down). The DKIM results come from uv run verify-dkim (see REPRODUCE.md).

4,283 emails (1.0%) have no readable text. Most of them are not broken: 3,513 consist only of attachments (a PDF, a scan, a calendar invitation), 281 are automatic read receipts, and in 230 Outlook packed the text into a winmail.dat attachment. 132 have an HTML part without any text (typically a newsletter made of images), 67 are encrypted, and only 60 are completely empty. No folder stands out: the share lies between 0.2% and 2.0% (schiedsgericht@). These emails still count in every number that is based on headers.

What is DKIM? A digital signature that the sender's mail server attaches to an email when sending it; if the text or one of the signed headers (such as sender, subject or date) is changed afterwards, the signature no longer matches.100,929 emails (24%) carry a DKIM signature. The share varies by year, from 11% (2018) to 44% (2026). (56 emails could not be parsed by the verifier; they count as unsigned.) What the signatures say today:

• 27,120 verify completely: text, headers and the sender's key, which is still published.
• 7,628 are mathematically intact, but expired or made with the outdated SHA-1.
• 20,993 have an unchanged text, but the sender's domain no longer publishes the key, so the header part can't be checked. That is normal for old mail: keys get replaced.
• 11,204 have an unchanged text, but the header check fails. Either a header line was changed on the way (mail gateways tag subjects, for example), or the domain has since published a new key under the same name.
• 33,805 have a text that no longer matches what the sender signed. This check needs no key, so it is reliable for old mail too.

A broken seal does not prove a forgery. An intact one says only that the text is what the sending server signed, not that it is true.

Edited emails? The changed texts are a technical pattern, not individual edits. 31,690 of the 33,805 emails with a changed text (94%) are in one folder, bundesschiedsgericht@. There, 92% of all signed emails from Feb 2015 to 17 September 2019 are affected, from every kind of sender (PayPal receipts, Gmail, Twitter …). Then it stops from one day to the next: of the 1,397 signed emails after that date, 1 is affected. The folder's volume drops sharply at the same time. In all other folders, 3.3% of the signed emails have a changed text, with no comparable cluster. Hand edits would hit a few chosen emails, not almost every PayPal receipt of a month. The pattern fits software that re-encoded the stored emails, for example when the mailbox was moved to another system. A separate check of 200 changed and 200 intact emails from this folder (not run in this notebook) supports that: 171 of the changed ones contain base64 blocks wrapped uniformly at 76 characters, against 85 of the intact ones. In the same check, appended or prepended text, line endings and mbox >From quoting explained none of the changes.

Part B: the website data

B0 · Where does it come from, and did the websites lead to the mail?

Two accounts can be checked against each other here: the archive itself, and the reconstruction by Lilith Wittmann and Hoodinformatik ("Zweimal gehackt", 20 October 2026), which rests on statements from the hackers and from people close to the hosting provider. What the article says happened: an insecure WordPress site, wahlkampf.afd.de, was the way in. A plugin (WP-Console) gave a command line on the server, from there the way led into the mail administration; the passwords of party officials' mailboxes were changed and the mail downloaded over IMAP. A first run was noticed on 9 September (about 180 GB), a second one on 14 September was stopped around 6 a.m. after about 300 GB in all. The systems belong to Alternita Dienstleistungs GmbH, the party's own service company, which runs hosting for many state and local associations. What the archive shows for itself: 04_TABULAR_DATA/000428_raw_console.jsonl is a log of 201 shell commands from 12 September, run with the rights of the wahlkampf.afd.de website, inside that site's folder. The commands and their output contain working passwords and API keys, so the notebook only shows when each command ran and what kind of step it was (read off the command, see analysis/access.py).

Read from the outputs of the same log:

• Passwords from the web server. The configuration files of every site on the machine are read, including database passwords.
• The mail-management system answers. The internal app behind mail-management.afd.de is read from disk; with a key found there, its API first refuses (HTTP 401), then returns data (HTTP 200). Around 16:30 a list of all mail users (≈0.9 MB) is downloaded and turned into a mailbox table. The archive's mailbox-management table (000678_mm_mailboxes.tsv) is the same kind of record.
• Mail-server logins work for a system account (no-reply@…) on three mail hosts.
• The direct route fails. For two hours there are attempts to mount the mail storage (NFS_…_MAIL_BACKEND) from the web server; every attempt is refused.
• Not visible in this log: the WP-Console plugin (it is also not among the site's active plugins in its exported settings), and the changing of mailbox passwords. Both may have happened outside this one session, which covers only 201 commands on one afternoon.

A second record cross-checks the article's hour. The archive also holds the mailbox table of the mail-management system (000678_mm_mailboxes.tsv, 2,219 mailboxes; the password column is not read here). It shows 6 new mailboxes on 14 September between 04:24 and 04:27 UTC (06:24–06:27 German time), each noted as "Backup-Account von …@afd.nrw". One of them is the backup of fabian.jacobi@afd.nrw, whose mailbox is in the archive. The table doesn't say who created them, or why. The timing fits the article's "detected around 6 a.m.". The table's newest change is from 08:47 UTC that morning, so this copy was made after the detection. Password changes, checked: 9 of the leaked mailbox folders appear in this table (the dotted leif.erik.holm@ doesn't: it is no mailbox of its own, which fits A2). Only 1 of them changed in September 2026 (schiedsgericht@afd.nrw at 05:24 UTC on 14 Sep), after the detection. The table keeps only the latest change per mailbox, so earlier changes could be overwritten, but for the untouched ones there is no sign of a password change through this system. If passwords were changed, it happened somewhere this table doesn't record.

How article and archive fit together:

Beyond the mail, the source's work files record further website access: database logins with credentials from site configuration files (wp-config) and backups, and a self-made single-sign-on token that, by their own record, gave admin access on afd-fraktion-hessen.de (000264_SERVER_ACCESS_LEDGER.tsv). wahlkampf.afd.de and alternita.de are both among the exported sites; Alternita also appears as the operator of an order system (bestellung.alternita.de) and as admin accounts named alternita_* on party sites.

B1 · How many websites leaked, and which domains?

Short answer: 139 websites: www.afd.de plus 138 other party-related sites. How that number comes about, because it differs from the "140" in DATA.md:

• 04_TABULAR_DATA/ holds table exports under 142 different export names.
• One of them (h4_route_samples) isn't a website (output of one of the source's tools).
• One (afd_de) is a later copy of www.afd.de, whose main database is in 02_DATABASES/.
• That leaves 140 export names (DATA.md's "140 other websites"). Each site's own siteurl setting shows that two pairs are the same site: afd-dessau-rosslau_de, afd_dessau_rosslau_de, ruben-rupp_de, test-micro_afd_de (afd-dessau-rosslau.de, ruben-rupp.de). test-micro.afd.de is a staging copy of ruben-rupp.de. So there are 138 distinct domains, plus www.afd.de.

Every domain below is read from the site's own database (siteurl setting), not guessed from the file name. The site types are this notebook's own grouping, read off the domain.

All 139 leaked websites (one row per distinct domain, grouped by site type; counts are distinct records in the leaked database, as in B2). Scroll the list; links open the live site.

B2 · What is in the website data?

A WordPress site keeps everything in database tables. The ones that matter, counted as distinct records (many sites were exported twice; counting rows would double-count):

The personal data is in the forms. 200,367 form submissions, two thirds of them on www.afd.de, hold what visitors typed in: names, email addresses, phone numbers, postal addresses, sometimes dates of birth. (Not every submission is a distinct person; see the bursts below.) Because these are party sites, a submission also hints at political sympathy (a special category under GDPR Art. 9). About the numbers: they come from src/analysis/wordpress.py and count distinct (site, table prefix, id). DATA.md's figures for the same tables are mostly 2–13% lower (e.g. 282,734 posts entries, 59,446 form submissions; comments are the exception, 2,708). No script for them exists in the repository, so the difference can't be traced. The sent-mail count matches exactly (20,047 on 109 sites) when the nine small 4–11-file site captures are left out, so DATA.md likely excluded some of those.

State associations (Bavaria, Saxony-Anhalt, Thuringia) and the party newspaper AfD Kompakt hold the most submissions; in.afdbayern.de (by its name, the Bavarian party's internal site) has by far the most accounts (477). The admin log column shows that many sites recorded every admin login and edit, with IP address. Sent-mail logs stop at exactly 250 on most sites: the logging plugin keeps only the latest ones.

The curve is flat (a few hundred to a few thousand a month) except for bursts: single days on which one form received 500+ submissions. There are 11 such days, holding 42,166 submissions (21% of all since 2017). The two big ones are on www.afd.de, where a normal day brings 20–150 submissions. What they are can't be told from these tables: a bot flood, a mass import or a coordinated campaign all look the same. The IP addresses don't settle it for www.afd.de, which records only a handful of distinct IPs on every day (probably a proxy). On sites that record real visitor IPs, bursts from 1–3 IPs (e.g. afd-lsa.de, afdbayern.de) are most likely automated. Either way, form submissions are not the same as people.

The biggest bursts

Most databases were copied in September/October 2026. The newest entry in each database shows this: a copy can't contain entries made after it was taken. For 106 of 138 sites the newest entry is from September or October 2026, so these databases were copied in those weeks, the last one on 5 October 2026. The other sites have an older newest entry. That doesn't necessarily mean they were copied earlier: either nothing happened on the site for a while, or the copy came from an older backup. For comparison, the newest email in the archive is from 14 September 2026.

B3 · How did the source process the data?

The source didn't just copy databases. Much of the archive is their own work: working queues, AI scores, tool output, and lists that re-sort the personal data into ready-to-use form. The flow below shows the archive by size: each folder, then what kind of material it holds. "Made by the source" is everything produced about the data rather than taken from a system.

Blue = original data taken from a system (290 GB, 98,917 files). Orange = made by the source, including some mixed working folders that also hold copied server files (11.0 GB, 2,050 files). Grey = public API snapshots and a public password list. By size the source's material is small next to the email, but by file count it isn't, and it includes the lists that matter most for privacy.

What the source built on top of the website databases (grouping by file name; counts inside the files are the source's, from DATA.md):

• Ready-made personal-data lists. 119 *.gf_named.tsv files match every form answer to its field label and class (email, first/last name, phone, city, member number, birth date). 226 more TSVs sweep every table of every site for anything that looks like personal data (362,398 rows, mostly noise). 000072_inf6_identities.tsv lists 6.65 million identifiers (IPs, emails, phones). For www.afd.de, a separate bundle in 02_DATABASES/ holds extracted emails (86,237), phone numbers, names and addresses.
• Triage. Keyword searches, category labels such as cat_illegal_activity, reading queues (MAIL_QUEUE_V2.tsv, 2.7 GB) and language-model scores. The briefing's "key findings" come from here: ~263,000 keyword-ranked records → 490 scored by a model → 136 rated high/critical → hand-checked sample.
• Records of the access. Probe results, download lists, credential-reuse tests and a ledger of server access.

None of this adds information that isn't in the original tables; it removes the effort. With these lists, collecting contact details at scale needs no database work at all.

Notes

• I analysed the data to the best of my knowledge and belief.
• Also to the best of my knowledge and belief, I removed data about private persons from the results shown here.
• I used AI for the analysis. Only models running locally on my own machine saw the source data. Models from other providers were used to generate code.
• The code to reproduce every step of this page is in the repository github.com/erikgoldenstein/afd-emails (instructions in REPRODUCE.md). The repository is currently offline and will be published once it is legally clear that this is permitted.
• An analysis of the emails' contents already exists. It too will only be published once there is more legal clarity.
• Contact: afd-emails@erik.gdn