What's in the leak
The hexane archive contains two independent datasets from different systems. They share only the occasional email address:- emails: ten mailboxes from the AfD's mail servers, and
- websites: the WordPress databases of www.afd.de and ~140 other party websites.
Part A: the emails
A1 · How many emails?
emails
421,178
conversations
49,554
email addresses
93,635
time span
2013–2026
DATA_DICTIONARY.md
),
and that holds. Only 42 emails share a Message-ID with another one,
and 81 have none. So "copies of the same email in several mailboxes" is
not a factor here: when two mailboxes held the same email, only one copy survived,
in one of the folders. (That matters in A2.)
The latest email is dated 14 September 2026: the emails end there. The website data (Part B)
reaches about three weeks further.The mailboxes cover very different windows: Gauland's runs 2017–2023,
bundesgeschaeftsstelle@
stops in early 2018, and the hyphenated Holm folder covers
just two weeks (A6). The 2016–2018 peak is mostly the bundesschiedsgericht@
folder, which
holds far more than the arbitration court's mail (A2). An empty cell means the archive has no emails from that folder for that year.A2 · Why DATA.md has two email tables with very different numbers
docs/DATA.md
shows one table per mailbox (e.g. bundesschiedsgericht@
holds
101,078 emails) and one per address (that same address "received" only 8,800).
Both are correct. They answer different questions:table | question it answers |
---|---|
per mailbox | In which folder of the archive is an email stored? |
per address | How often is an address written in an email's From/To/Cc/Bcc line, anywhere in the archive? |
Delivered-To
header, which shows what happened:Three folders show the effect clearly:
- Gauland: 32,615 emails stored. His address is in To/Cc only 13,167 times (DATA.md's "received" figure, 14,482, adds mentions in other folders). Yet the server recorded him as the real recipient on 32,600 (100%). Most of his mail reached him as Bcc, via lists or aliases. And he sent only 15 of them: this is an inbox, not a sent folder.
bundesschiedsgericht@
(federal arbitration court): 101,078 emails, but only 14,311 (14%) involve that address in any header. The folder is mostly other people's mail: the Sankey below shows Alice Weidel's,paypal@
, Magnus Heutmann's and others. The folder name says where the source filed the mail, not whose mailbox it was.leif.erik.holm@
(dotted): 60,215 emails, and the dotted address appears in none of them (0). It is the mail ofleif-erik.holm@
(hyphen), the MV party officebuero@afd-mv.de
, the press office and others.
Green links: delivered to the folder's own namesake. Violet: delivered to someone else. Grey: no delivery header (the server didn't record one) or smaller recipients folded into other. Hover a link for its count.
A3 · How many email threads?
A thread here is a set of emails linked through the Message-IDs they cite in theirIn-Reply-To
/References
headers (threads/
in the corpus; no subject matching).
The headline number depends on what you call a thread:- 300,807 threads if every unanswered email counts as its own thread.
- 49,554 conversations if a thread needs at least two emails. These hold 169,925 emails (40% of all).
A4 · Who sends the emails? Spam, politicians, AfD, companies, private persons
Each email gets one category from its sender address. The rules are simple and applied in order (first match wins). They live insrc/analysis/senders.py
:# | category | rule |
---|---|---|
0 | No sender address | the From header has no parsable address |
1 | Spam | server spam verdict, a spam-tagged subject, a throwaway top-level domain (.su, .mom, .makeup, …), or a rotating domain: ≥10 emails, ≥80% from a different address each time |
2 | AfD | a party domain (afd… , alternativefuer… , party shop/hosting) |
3 | Politics & state | parliaments (Bundestag, Landtage, EU), other parties, government, police, courts, city administrations |
4 | Automated & newsletters | auto-reply or mailing-list headers, no-reply/newsletter-style addresses, platforms (PayPal, Twitter, Amazon, …) |
5 | Private persons | a freemail provider (gmail, web.de, gmx, t-online, …): individuals writing from a personal account |
6 | Companies & orgs | everything else: a sender with its own non-party domain (businesses, associations, media, law firms) |
@bundestag.de
counts under Politics & state, one writing from gmail under Private persons.Short answer: about half of all email is AfD talking (53%):
party offices, officials and party systems, from only 2,785 addresses.
Private persons come next (18%), from by far the most addresses
(17,247), followed by companies (15%;
printers, merch suppliers, IT, lawyers, associations) and automated mail
(10%; PayPal alone sends 22,000). Politics & state outside the
AfD domains is small (2%; mostly
@bundestag.de
). Spam
is 8,618 emails (2%), but from almost as many
distinct addresses, the typical signature of spam.Spam: the server's flag vs. these rules
Yes, there is a spam flag from the mail server (X-Spam-Flag
, plus X-Spam-Score
). But
it can't answer "how much is spam" alone: most emails have no verdict at all,
because they passed through servers that didn't add one. Where a verdict exists, it lets
us check the rules above:- 51,998 of 421,178 emails (12%) carry a server
verdict: 1,227 YES, 50,771 NO. Coverage depends on the mail server: 100% for
the hyphenated Holm folder, under 1% for
bundesschiedsgericht@
. - With the verdict hidden, the rules still catch 815 of the 1,227 server-YES emails (66%).
- They also call 2,036 server-NO emails spam (4% of them). A random sample (below) shows these are spam the server missed, not false alarms.
- On the 369,180 emails with no verdict, the rules find 5,324 spam.
Random sample: server said NO, rules say spam
subject (server said: not spam) | rule |
---|---|
Gelenkschmerzen loswerden | rotating sender addresses |
Effektive Schmerzbehandlung | rotating sender addresses |
Toxictm Off - Reinigt das Blut und Organe von Giften | throwaway top-level domain |
Ist dein Messer unscharf? Mit Wolframcarbid-Messerschärfer kannst du i | rotating sender addresses |
Die Verbesserung der Potenz und der Libido in jedem Alter | rotating sender addresses |
Richtige Behandlung fur Bluthochdruck | rotating sender addresses |
=?UTF-8?Q?St=C3=B6rt_dich, _dass_deine_Z=C3=A4hne_nicht_makellos_sind= | rotating sender addresses |
Hochkonzentriertes Cannabisöl | rotating sender addresses |
Gelenkschmerzen loswerden | rotating sender addresses |
RE: Shipping services from China to worldwide | rotating sender addresses |
Die Psoriasis kann endlich geheilt werden | throwaway top-level domain |
Plus 1 Duschkopf als Geschenk: hautfreundliche Dusche zaubert seidig | rotating sender addresses |
AfD and politics & state: who exactly?
Left (blue): the AfD. 221,769 emails come from party addresses, spread over 428 domains (the part of an address after the @) and 2,785 addresses. The chart shows the 10 domains that sent the most emails. Each bar is one domain. Its length and the number at its end give how many emails from addresses at that domain are in the ten mailboxes. Together these 10 domains account for 85% of all AfD emails. Right (orange): politics & state, meaning parliaments, other parties, government, courts and police (8,770 emails), split by kind of sender. Here too, the number at each bar is the number of emails.Bundestag mail (7,068 emails from 155 addresses) is concentrated: 90% comes from 15 addresses, which belong tomarkus.frohnmaier
, leif-erik.holm
, beatrix.vonstorch
, enrico.komning
, alice.weidel
, michael.espendiller
, anton.friesen
and their staff (.maNN
). These are AfD MPs, so most of Politics & state is in fact AfD people writing from parliament accounts. Other parties barely appear as senders.Each bar splits a category's sender addresses by how many emails each one sent. Private persons are mostly one-off writers: 13,199 of 17,247 private addresses (77%) wrote exactly once, members of the public writing to the party. AfD addresses are few but prolific. Spam is almost entirely 1 email: a new address every time.
A5 · What does it look like as a network?
Every address is a node. An edge goes from a sender to each address in To/Cc/Bcc, weighted by the number of emails.addresses that sent or received
77,610
sender → recipient pairs
294,621
in one connected cluster
86%
pairs that wrote both ways
13%
Read a row as this kind of sender, a column as writes to this kind of recipient. A delivery is one
(email, recipient) pair, so one email to 100 recipients counts 100 times. That makes mass mailers loom large:
- AfD → AfD is the biggest block: internal mail and party mailing lists.
- Private persons → Politics looks big (10%), but it is inflated by people mailing whole parliaments: the 10 busiest private senders account for 34% of it, and 25% of all deliveries by private senders.
- The same goes for Companies → Companies: the largest single sender in the archive,
musik-baron.de
, sent ~1,900 emails to ~100 recipients each (party addresses, MPs, media).
A two-way contact is the simplest sign of a real correspondence. Only a minority of private persons and companies ever got a reply in the archive. (Replies sent from addresses or mailboxes outside the archive are invisible here, so this is a lower bound.)
Two clusters dominate. On one side NRW (state office, arbitration court, Jacobi's three addresses, the state board), linked to the MV office (7, 16) and the fan shop (5, 6). On the other, the federal party around Gauland and Weidel (17, 11), surrounded by private and company mass mailers who write to them and to MPs of all parties (the large green dot, no. 1, is one such sender). Not shown: PayPal's notifications to
paypal@alternativefuer.de
, which form a separate island. Private persons are not named: they are listed by their mail provider only, and those writing from their own domain as own domain, without it (the sender rules count such domains as companies; here they are shown as private persons). The point is the structure, not identifying individuals.A6 · Weird structures
Things in the email data that are not what they look like:- Two Holm mailboxes, and the bigger one never names its namesake. The dotted
leif.erik.holm@afd-mv.de
folder holds 60,215 emails from 2019 to 2026, but that spelling appears in no header of any email in the archive. The real address is the hyphenatedleif-erik.holm@
, whose own folder holds just 247 emails from 25 Dec 2022 to 9 Jan 2023, covering two weeks. The source's briefing lists only the hyphenated address. - Folders named after one address hold others' mail.
bundesschiedsgericht@
is mostly Alice Weidel's,paypal@
's and Magnus Heutmann's mail (A2). A folder name says where the source filed the mail, not whose inbox it was. unknown/
isn't unknown. Its 7,237 emails have no folder owner, but where a delivery header exists it names real accounts:bundesgeschaeftsstelle@alternativefuer.de
(1,147),fabian.jacobi@afd.nrw
(342),buero@afd-mv.de
(245).- Inboxes vs. sent mail differ per folder. The namesake sent 0%
of the emails in
alexander.gauland@
but 68% inbundesgeschaeftsstelle@
. Gauland's folder is an inbox (15 sent emails in six years). Questions like "how often did X reply" can only be answered where sent mail is in the archive. sebastian.lux@
effectively stops in 2021. 31,817 of its 32,020 emails are from before 2022, then only 203 trickle in until 2026.- Delivery headers depend on the server, not the person. From 0% of emails
(
sebastian.lux@
) to 100% (leif-erik.holm@
). Where they're missing, Bcc and list recipients are invisible. - Mass mail. 31,750 emails have the exact same text as another email (newsletters, notifications, mailings sent one recipient at a time), though each has its own Message-ID.
- Addresses that never send or receive. 14,774 of the 93,635 addresses appear only in a Reply-To header, typically web forms and newsletters ("reply to this person, not to me"). This is why DATA.md counts 93,635 addresses overall, but only 78,861 as senders or recipients.
A7 · How complete and how authentic are the emails?
Two checks on the quality of the data. First: how many emails have no readable text? Second: are the emails still exactly as they were sent? For many emails this can be checked through their DKIM signature (explained further down). The DKIM results come fromuv run verify-dkim
(see REPRODUCE.md).4,283 emails (1.0%) have no readable text. Most of them are not broken:
3,513 consist only of attachments (a PDF, a scan, a calendar invitation),
281 are automatic read receipts, and in 230 Outlook packed the text into a
winmail.dat
attachment. 132 have an HTML part without any text (typically a
newsletter made of images), 67 are encrypted, and only 60 are
completely empty.
No folder stands out: the share lies between 0.2% and 2.0% (schiedsgericht@
). These emails still
count in every number that is based on headers.What is DKIM? A digital signature that the sender's mail server attaches to an email when sending it; if the text or one of the signed headers (such as sender, subject or date) is changed afterwards, the signature no longer matches.100,929 emails (24%) carry a DKIM signature. The share varies by year,
from 11% (2018) to 44% (2026). (56 emails could not be
parsed by the verifier; they count as unsigned.)
What the signatures say today:
- 27,120 verify completely: text, headers and the sender's key, which is still published.
- 7,628 are mathematically intact, but expired or made with the outdated SHA-1.
- 20,993 have an unchanged text, but the sender's domain no longer publishes the key, so the header part can't be checked. That is normal for old mail: keys get replaced.
- 11,204 have an unchanged text, but the header check fails. Either a header line was changed on the way (mail gateways tag subjects, for example), or the domain has since published a new key under the same name.
- 33,805 have a text that no longer matches what the sender signed. This check needs no key, so it is reliable for old mail too.
Edited emails? The changed texts are a technical pattern, not individual edits.
31,690 of the 33,805 emails with a changed text (94%) are in one folder,
bundesschiedsgericht@
. There, 92% of all signed emails from Feb 2015 to 17 September 2019 are
affected, from every kind of sender (PayPal receipts, Gmail, Twitter …). Then it stops from
one day to the next: of the 1,397 signed emails after that date, 1 is
affected. The folder's volume drops sharply at the same time. In all other folders, 3.3%
of the signed emails have a changed text, with no comparable cluster.
Hand edits would hit a few chosen emails, not almost every PayPal receipt of a month. The
pattern fits software that re-encoded the stored emails, for example when the mailbox was
moved to another system. A separate check of 200 changed and 200 intact emails from this
folder (not run in this notebook) supports that: 171 of the changed ones contain base64
blocks wrapped uniformly at 76 characters, against 85 of the intact ones. In the same check,
appended or prepended text, line endings and mbox >From
quoting explained none of the changes.Part B: the website data
B0 · Where does it come from, and did the websites lead to the mail?
Two accounts can be checked against each other here: the archive itself, and the reconstruction by Lilith Wittmann and Hoodinformatik ("Zweimal gehackt", 20 October 2026), which rests on statements from the hackers and from people close to the hosting provider. What the article says happened: an insecure WordPress site, wahlkampf.afd.de, was the way in. A plugin (WP-Console) gave a command line on the server, from there the way led into the mail administration; the passwords of party officials' mailboxes were changed and the mail downloaded over IMAP. A first run was noticed on 9 September (about 180 GB), a second one on 14 September was stopped around 6 a.m. after about 300 GB in all. The systems belong to Alternita Dienstleistungs GmbH, the party's own service company, which runs hosting for many state and local associations. What the archive shows for itself:04_TABULAR_DATA/000428_raw_console.jsonl
is a
log of 201 shell commands from 12 September, run with the rights of the wahlkampf.afd.de website,
inside that site's folder. The commands and their output contain working passwords and
API keys, so the notebook only shows when each command ran and what kind of step it was
(read off the command, see analysis/access.py
).Read from the outputs of the same log:
- Passwords from the web server. The configuration files of every site on the machine are read, including database passwords.
- The mail-management system answers. The internal app behind
mail-management.afd.de
is read from disk; with a key found there, its API first refuses (HTTP 401), then returns data (HTTP 200). Around 16:30 a list of all mail users (≈0.9 MB) is downloaded and turned into a mailbox table. The archive's mailbox-management table (000678_mm_mailboxes.tsv
) is the same kind of record. - Mail-server logins work for a system account (
no-reply@…
) on three mail hosts. - The direct route fails. For two hours there are attempts to mount the mail storage
(
NFS_…_MAIL_BACKEND
) from the web server; every attempt is refused. - Not visible in this log: the WP-Console plugin (it is also not among the site's active plugins in its exported settings), and the changing of mailbox passwords. Both may have happened outside this one session, which covers only 201 commands on one afternoon.
A second record cross-checks the article's hour. The archive also holds the mailbox table of the
mail-management system (
000678_mm_mailboxes.tsv
, 2,219 mailboxes; the password column is not read here).
It shows 6 new mailboxes on 14 September between 04:24 and
04:27 UTC (06:24–06:27
German time), each noted as "Backup-Account von …@afd.nrw". One of them is the backup of
fabian.jacobi@afd.nrw
, whose mailbox is in the archive. The table doesn't say who created them, or why.
The timing fits the article's "detected around 6 a.m.". The table's newest change is from
08:47 UTC that morning, so this copy was made after the detection.
Password changes, checked: 9 of the leaked mailbox folders appear in this table
(the dotted leif.erik.holm@
doesn't: it is no mailbox of its own, which fits A2).
Only 1 of them changed in September 2026 (schiedsgericht@afd.nrw
at 05:24 UTC on 14 Sep), after the detection.
The table keeps only the latest change per mailbox, so earlier changes could be overwritten, but for the
untouched ones there is no sign of a password change through this system. If passwords were changed,
it happened somewhere this table doesn't record.How article and archive fit together:
Beyond the mail, the source's work files record further website access: database logins with
credentials from site configuration files (
Claim in the article | What the archive says |
---|---|
The way in was the WordPress site wahlkampf.afd.de | Supported. The shell log runs as that site's user, in its folder. |
WP-Console gave the command line | Not shown. Neither the shell log nor the site's exported settings name it. |
From there into the mail administration | Supported. The log reads the mail-management app and pulls the full user list through its API. |
Mailbox passwords were changed, mail downloaded over IMAP | IMAP plausible, password changes not seen. IMAP logins work in the log; the mail-management table shows no September change on the mailboxes in the archive before the detection (see above). |
First run noticed on 9 Sept | Not confirmed. No email in the corpus mentions an incident. The only notice is planned "further server work" on the party's member system for 14–15 Sept, announced on 10 Sept; that may or may not be related. |
Access kept after the first run | Consistent. The shell session was on 12 Sept, and the newest emails in the mailboxes are from 11 to 14 Sept. |
Second run detected around 6 a.m. on 14 Sept | Supported. 6 "Backup-Account" mailboxes appear between 06:24 and 06:27 German time. The newest emails are from 08:29 and 09:04 German time, so mail still arrived, or was still copied, after that. |
≈300 GB in total | Matches the publication. The archive is 302 GB, of which 225 GB is email; the rest is website databases, documents and images. The split into 180 GB and 120 GB can't be checked: the source's upload records only cover the three oldest mailboxes. |
The same mailboxes were copied twice | Consistent. Only 42 emails share a Message-ID, so the second copies were removed before publishing. |
AfD: mainly older mailboxes | Partly. Three folders end before September 2026 (Gauland 2023, Bundesgeschäftsstelle 2018, the hyphenated Holm address 2023), but the large ones reach into September 2026. |
Access to ≈300 mailboxes, largest first | Consistent. The archive holds 10 named mailbox folders, a small, large-volume selection out of the 2,219 the mail-management system lists. |
Alternita runs 300+ domains | Not comparable. That counts domains (the mail system alone lists 500); B1 counts the WordPress databases that were exported. |
wp-config
) and backups, and a self-made single-sign-on
token that, by their own record, gave admin access on afd-fraktion-hessen.de
(000264_SERVER_ACCESS_LEDGER.tsv
). wahlkampf.afd.de and alternita.de are both among the
exported sites; Alternita also appears as the operator of an order system (bestellung.alternita.de
)
and as admin accounts named alternita_*
on party sites.B1 · How many websites leaked, and which domains?
Short answer: 139 websites: www.afd.de plus 138 other party-related sites. How that number comes about, because it differs from the "140" in DATA.md:04_TABULAR_DATA/
holds table exports under 142 different export names.- One of them (
h4_route_samples
) isn't a website (output of one of the source's tools). - One (
afd_de
) is a later copy of www.afd.de, whose main database is in02_DATABASES/
. - That leaves 140 export names (DATA.md's "140 other websites"). Each site's own
siteurl
setting shows that two pairs are the same site:afd-dessau-rosslau_de
,afd_dessau_rosslau_de
,ruben-rupp_de
,test-micro_afd_de
(afd-dessau-rosslau.de, ruben-rupp.de).test-micro.afd.de
is a staging copy ofruben-rupp.de
. So there are 138 distinct domains, plus www.afd.de.
siteurl
setting), not guessed from
the file name. The site types are this notebook's own grouping, read off the domain.All 139 leaked websites (one row per distinct domain, grouped by site type; counts are distinct records in the leaked database, as in B2). Scroll the list; links open the live site.
# | domain | site title (its own setting) | accounts | form entries | posts & pages | comments | newest entry |
---|---|---|---|---|---|---|---|
National party, campaigns & media | |||||||
1 | afd.de | Alternative für Deutschland | 7 | 138,049 | 5,214 | 0 | 2026-10-04 |
2 | afdkompakt.de | AfD Kompakt | 18 | 5,080 | 12,166 | 0 | 2026-09-29 |
3 | bilddatenbank.afd.de | bilddatenbank.afd.de | 2 | 0 | 2 | 0 | 2026-09-29 |
4 | gemeinsam-fuer-das-grundgesetz.de | Gemeinsam für das Grundgesetz | 6 | 0 | 20 | 0 | 2025-07-07 |
5 | generationdeutschland.de | Generation Deutschland | 8 | 53 | 9 | 0 | 2026-08-28 |
6 | mitmachen.afd.de | Mitmachen in der AfD | 4 | 0 | 16 | 0 | 2026-09-29 |
7 | sachsen-anhalt.afd.de | AfD Sachsen-Anhalt | 0 | 0 | 9 | 0 | 2025-05-13 |
8 | spenden.afd.de | AfD Spenden | 4 | 0 | 9 | 0 | 2026-09-29 |
9 | wahlkampf.afd.de | Wahlkampfportal der AfD | 6 | 0 | 39 | 0 | 2025-12-10 |
State association | |||||||
10 | afd-brandenburg.de | AfD Brandenburg | 7 | 0 | 248 | 7 | 2026-09-03 |
11 | afd-frauen.nrw | Frauen in der AfD | 4 | 0 | 12 | 3 | 2026-09-29 |
12 | afd-lsa.de | AfD Sachsen-Anhalt | 9 | 8,573 | 288 | 0 | 2025-10-17 |
13 | afd-mv.de | Alternative für Deutschland Mecklenburg-Vorpommern | 11 | 1,548 | 4,367 | 3 | 2026-10-05 |
14 | afd-thueringen.de | AfD Thüringen | 39 | 3,512 | 4,819 | 79 | 2026-10-03 |
15 | afd.berlin | AfD Landesverband Berlin | 10 | 546 | 60 | 0 | 2026-10-02 |
16 | afd.nrw | AfD NRW | 9 | 1,106 | 2,118 | 8 | 2026-10-03 |
17 | afd.saarland | AfD Saarland | 5 | 1,237 | 811 | 4 | 2026-10-03 |
18 | afdbayern.de | AfD Bayern | 16 | 9,485 | 1,625 | 4 | 2026-10-04 |
19 | alternative-rlp.de | AfD Rheinland-Pfalz | 8 | 969 | 751 | 4 | 2026-01-02 |
20 | in.afdbayern.de | Bayern intern | 477 | 556 | 360 | 0 | 2026-09-09 |
21 | plakatshop.afdbayern.de | AfD Bayern Plakatshop | 66 | 0 | 18 | 109 | 2026-09-29 |
22 | russlanddeutsche-afd.nrw | Russlanddeutsche für die AfD NRW | 6 | 416 | 1,194 | 3 | 2026-08-24 |
Regional association | |||||||
23 | afd-bezirk-arnsberg.de | AfD Bezirk Arnsberg | 8 | 352 | 75 | 53 | 2026-09-15 |
24 | afd-bezirk-duesseldorf.de | AfD Bezirk Düsseldorf | 9 | 215 | 95 | 0 | 2024-08-09 |
25 | afd-bezirk-muenster.de | AfD Bezirk Münster | 9 | 195 | 63 | 15 | 2026-09-24 |
26 | afd-bezirk-owl.de | AfD Bezirk Ostwestfalen-Lippe | 9 | 223 | 457 | 18 | 2026-09-29 |
27 | afd-oberbayern.de | AFD Oberbayern | Bezirksverband Oberbayern | Alternative für | 7 | 89 | 102 | 19 | 2026-09-30 |
Local chapter | |||||||
28 | afd-anhalt-bitterfeld.de | AfD Kreisverband Anhalt-Bitterfeld | 10 | 439 | 173 | 24 | 2026-10-01 |
29 | afd-aw.de | AfD Ahrweiler | 10 | 161 | 564 | 0 | 2026-09-30 |
30 | afd-bad-kissingen.de | AfD Bad Kissingen | 5 | 74 | 20 | 0 | 2026-10-02 |
31 | afd-bgl.de | AfD Berchtesgadener Land | 7 | 0 | 126 | 6 | 2026-09-04 |
32 | afd-bielefeld.de | AfD Kreis Bielefeld | 17 | 133 | 3,237 | 4 | 2026-10-03 |
33 | afd-bottrop.de | AfD Kreis Bottrop | 10 | 370 | 194 | 45 | 2026-10-04 |
34 | afd-dessau-rosslau.de | AfD Kreis Dessau-Roßlau Stadt | 8 | 296 | 619 | 15 | 2026-01-07 |
35 | afd-dortmund.de | AfD Kreis Dortmund | 8 | 787 | 543 | 50 | 2026-10-02 |
36 | afd-duisburg.de | AfD Kreisverband Duisburg | 6 | 708 | 95 | 27 | 2026-09-29 |
37 | afd-ennepe-ruhr.de | AfD - Kreisverband Ennepe-Ruhr | 5 | 412 | 15 | 0 | 2026-09-30 |
38 | afd-essen.de | AfD Kreis Essen | 4 | 707 | 297 | 52 | 2026-09-08 |
39 | afd-euskirchen.de | AfD Kreis Euskirchen | 7 | 483 | 47 | 3 | 2026-06-10 |
40 | afd-hagen.de | AfD Kreisverband Hagen | 7 | 272 | 230 | 46 | 2026-09-23 |
41 | afd-harzkreis.de | AfD Kreisverband Harz | 8 | 135 | 24 | 1 | 2026-09-10 |
42 | afd-hassberge.de | AfD Haßberge / Rhön-Grabfeld | 7 | 71 | 20 | 0 | 2026-09-30 |
43 | afd-herford.de | AfD Kreis Herford | 8 | 204 | 500 | 28 | 2026-10-05 |
44 | afd-hochsauerlandkreis.de | AfD Hochsauerlandkreis | 7 | 121 | 58 | 9 | 2026-10-04 |
45 | afd-hro.de | AfD Hansestadt Rostock | 9 | 111 | 23 | 0 | 2026-09-18 |
46 | afd-iserlohn.de | AfD Fraktion im Stadtrat Iserlohn | 5 | 262 | 46 | 3 | 2025-12-01 |
47 | afd-kelheim.de | AfD Kreisverband Kelheim | 4 | 4 | 55 | 0 | 2026-10-04 |
48 | afd-krefeld.de | AfD Kreis Krefeld | 10 | 423 | 143 | 9 | 2026-10-05 |
49 | afd-kreis-borken.de | AfD Kreis Borken | 7 | 350 | 189 | 13 | 2026-09-29 |
50 | afd-kreis-coesfeld.de | AfD Kreis Coesfeld | 9 | 258 | 199 | 9 | 2026-09-29 |
51 | afd-kreis-duesseldorf.de | AfD Kreis Düsseldorf | 8 | 625 | 248 | 32 | 2025-10-10 |
52 | afd-kreis-hamm.de | AfD Kreis Hamm | 7 | 484 | 160 | 7 | 2026-10-04 |
53 | afd-kreis-olpe.de | AfD Kreis Olpe | 9 | 44 | 153 | 5 | 2026-09-30 |
54 | afd-kreis-recklinghausen.de | AfD Kreis Recklinghausen | 9 | 686 | 1,392 | 104 | 2026-09-30 |
55 | afd-kreis-wesel.de | AfD Kreisverband Wesel | 5 | 551 | 283 | 61 | 2026-05-21 |
56 | afd-kreisverband-rottal-inn.de | AfD Kreisverband Rottal-Inn | 0 | 0 | 47 | 0 | 2026-10-03 |
57 | afd-landsberg-lech.de | Afd Landsberg Lech | 8 | 85 | 23 | 7 | 2026-09-30 |
58 | afd-lichtenfels.de | AFD Kreisverband Lichtenfels | 9 | 75 | 55 | 0 | 2026-09-30 |
59 | afd-main-spessart.de | AfD Kreisverband Main-Spessart | 6 | 89 | 15 | 0 | 2026-09-30 |
60 | afd-mettmann.de | AfD Kreis Mettmann | 13 | 581 | 1,319 | 18 | 2025-08-18 |
61 | afd-minden-luebbecke.de | AfD Kreisverband Minden-Lübbecke | 5 | 519 | 426 | 45 | 2026-10-03 |
62 | afd-moenchengladbach.de | AfD Kreis Mönchengladbach | 12 | 666 | 39 | 0 | 2025-12-03 |
63 | afd-mse.de | AfD Kreisverband Mecklenburgische Seenplatte | 6 | 575 | 185 | 14 | 2026-10-01 |
64 | afd-muelheim.de | AfD Kreis Mülheim | 10 | 672 | 343 | 32 | 2026-10-04 |
65 | afd-muenchen-land.de | Kreisverband München Land | 6 | 78 | 15 | 51 | 2026-10-02 |
66 | afd-muenchen-ost.de | AfD Kreis München Ost | 7 | 108 | 122 | 4 | 2026-02-20 |
67 | afd-muenchen.de | AfD München | 18 | 143 | 917 | 0 | 2026-10-01 |
68 | afd-muenster.de | AfD Kreisverband Münster | 8 | 794 | 1,109 | 52 | 2026-09-29 |
69 | afd-neuburg-schrobenhausen.de | AfD Kreis ND-SOB | 1,932 | 293 | 16 | 0 | 2026-09-30 |
70 | afd-nwm.de | AfD Kreisverband Nordwestmecklenburg | 9 | 273 | 1 | 0 | 2026-09-29 |
71 | afd-oberberg.de | AfD Kreisverband Oberberg | 1,816 | 498 | 863 | 288 | 2026-10-04 |
72 | afd-oberhausen.de | AfD Oberhausen | 7 | 311 | 1,148 | 2 | 2026-10-04 |
73 | afd-passau.de | AfD Kreisverband Passau | 7 | 74 | 55 | 3 | 2026-10-03 |
74 | afd-rhein-kreis-neuss.de | AfD Rhein Kreis Neuss | 14 | 373 | 369 | 0 | 2025-09-25 |
75 | afd-ro.de | AfD Kreisverband Landkreis Rostock | 7 | 557 | 284 | 12 | 2026-09-29 |
76 | afd-schwarzwald-baar.de | AfD Kreisverband Schwarzwald-Baar | 8 | 218 | 20 | 0 | 2026-10-03 |
77 | afd-schweinfurt-land.de | AfD Kreisverband Schweinfurt-Land | 5 | 4 | 5 | 0 | 2026-09-30 |
78 | afd-siegen-wittgenstein.de | AfD Kreis Siegen-Wittgenstein | 7 | 489 | 403 | 17 | 2026-03-03 |
79 | afd-sn.de | AfD Kreisverband Schwerin | 4 | 326 | 17 | 13 | 2026-06-25 |
80 | afd-swm.de | AfD Kreis Südwestmecklenburg | 7 | 181 | 36 | 16 | 2026-07-05 |
81 | afd-trier.de | AfD Kreisverband Trier | 6 | 261 | 50 | 10 | 2026-09-30 |
82 | afd-unterallgaeu-memmingen.de | AfD Kreis Unterallgäu-Memmingen | 9 | 255 | 426 | 37 | 2026-09-30 |
83 | afd-vg.de | AfD Kreisverband Vorpommern-Greifswald | 7 | 239 | 1,999 | 0 | 2026-10-02 |
84 | afd-vr.de | AfD Kreisverband Vorpommern-Rügen | 7 | 383 | 190 | 26 | 2025-10-25 |
85 | afd-weiden.de | AfD Weiden | Kreisverband | 5 | 26 | 696 | 0 | 2026-10-02 |
86 | afd-weilheim-schongau.de | AfD Kreisverband | 7 | 8 | 116 | 30 | 2026-09-09 |
87 | afd-wuerzburg.de | AfD Kreis Würzburg | 4 | 284 | 53 | 14 | 2026-09-30 |
88 | afd-wuppertal.de | AfD Kreis Wuppertal | 5 | 0 | 29 | 12 | 2026-09-29 |
89 | afd.koeln | AfD Köln | 13 | 1,402 | 651 | 16 | 2026-10-05 |
90 | afdosnabrueck.de | AfD Kreisverband Osnabrück | 6 | 368 | 193 | 30 | 2026-10-04 |
91 | afdsaarpfalz.de | AfD Saarpfalz | 5 | 39 | 18 | 0 | 2026-09-30 |
92 | alternative-fuer-mk.de | AfD Märkischer Kreis | 9 | 816 | 184 | 16 | 2026-10-03 |
93 | kebst-blue.volker-heinecke.de | Katrin Ebner-Steiner | 13 | 366 | 199 | 58 | 2026-09-29 |
Berlin district | |||||||
94 | friedrichshain-kreuzberg.afd.berlin | AfD Bezirk Friedrichshain-Kreuzberg | 17 | 18 | 24 | 0 | 2026-08-31 |
95 | lichtenberg.afd.berlin | AfD-Bezirksverband Lichtenberg | 9 | 18 | 153 | 0 | 2026-10-02 |
96 | marzahn-hellersdorf.afd.berlin | AfD Bezirksverband Marzahn-Hellersdorf | 10 | 18 | 208 | 70 | 2026-09-14 |
97 | mitte.afd.berlin | AfD Bezirksverband Berlin Mitte | 9 | 18 | 12 | 0 | 2026-08-31 |
98 | neukoelln.afd.berlin | AfD Bezirksverband Neukölln | 6 | 18 | 49 | 0 | 2026-08-25 |
99 | pankow.afd.berlin | AfD Berlin-Pankow | 10 | 1,782 | 80 | 86 | 2026-10-02 |
100 | reinickendorf.afd.berlin | AfD Bezirksverband Reinickendorf | 11 | 18 | 145 | 110 | 2026-08-31 |
101 | spandau.afd.berlin | AfD Bezirk Spandau | 8 | 18 | 16 | 48 | 2026-09-06 |
102 | steglitz-zehlendorf.afd.berlin | AfD Steglitz-Zehlendorf | 12 | 18 | 13 | 0 | 2026-09-18 |
103 | tempelhof-schoeneberg.afd.berlin | AfD Bezirksverband Tempelhof-Schöneberg | 11 | 18 | 33 | 0 | 2026-09-10 |
104 | treptow-koepenick.afd.berlin | AfD Treptow-Köpenick | 8 | 18 | 87 | 18 | 2026-09-30 |
Parliamentary group | |||||||
105 | afd-do-fraktion.de | Aktuelles | 6 | 27 | 887 | 12 | 2026-09-30 |
106 | afd-fraktion-duisburg.de | AfD-Fraktion im Rat der Stadt Duisburg | 9 | 82 | 360 | 12 | 2026-10-04 |
107 | afd-fraktion-en.de | Alternative für Deutschland, Kreistagsfraktion Ennepe-Ruhr | 6 | 29 | 97 | 17 | 2026-09-30 |
108 | afd-fraktion-hessen.de | AfD-Fraktion Hessen | 9 | 939 | 1,354 | 14 | 2025-09-08 |
109 | afd-fraktion-luenen.de | AfD Fraktion im Stadtrat Lünen | 9 | 75 | 115 | 118 | 2026-09-30 |
110 | afd-fraktion-rkn.de | AfD-Fraktion Rhein-Kreis Neuss | 6 | 39 | 26 | 2 | 2025-09-25 |
111 | afd-fraktion-siegen.de | AfD-Ratsfraktion Siegen | 4 | 158 | 52 | 3 | 2026-09-30 |
112 | afd-fraktion-tk.de | AfD Fraktion Treptow-Köpenick | 8 | 375 | 607 | 45 | 2026-09-30 |
113 | afd-fraktion-vg.de | AfD-Fraktion Vorpommern-Greifswald | 9 | 22 | 85 | 0 | 2026-09-30 |
114 | afd-fraktion-witten.de | Alternative für Deutschland Ratsfraktion Witten | 5 | 147 | 118 | 22 | 2026-10-02 |
115 | afd-fraktion-wuppertal.de | AfD-Fraktion im Rat der Stadt Wuppertal | 8 | 32 | 48 | 9 | 2026-09-30 |
116 | afd-fraktion.koeln | AfD-Fraktion im Rat der Stadt Köln | 7 | 370 | 814 | 27 | 2026-10-01 |
117 | afd-fraktion.saarland | AfD Fraktion Saarlandes | 5 | 105 | 48 | 7 | 2026-10-03 |
118 | afd-im-roemer.de | AfD-Fraktion im Römer | 7 | 224 | 918 | 20 | 2026-09-30 |
119 | afd-kreistag-abi.de | AfD im Kreistag Anhalt-Bitterfeld | 7 | 114 | 49 | 8 | 2026-09-30 |
120 | afd-kreistag-rostock.de | AfD Fraktion - Bündnis Deutschland | 7 | 53 | 165 | 29 | 2026-09-30 |
121 | afd-kreistag-siwi.de | AfD im Kreistag Siegen-Wittgenstein | 6 | 22 | 67 | 10 | 2026-09-30 |
122 | afd-kreistagsfraktion-hsk.de | afd-kreistagsfraktion-hsk | 0 | 0 | 29 | 0 | 2026-10-03 |
123 | afd-ratsfraktion-bottrop.de | AfD-Ratsfraktion Bottrop | 9 | 7 | 219 | 10 | 2026-09-30 |
124 | afd-stadtrat-muenchen.de | Offizielle Seite der AfD im Münchner Stadtrat. | 8 | 0 | 459 | 2 | 2026-09-30 |
125 | afd-stadtrat-trier.de | Die Demokraten im Stadtrat Trier | 8 | 24 | 145 | 13 | 2026-03-16 |
Politician's own site | |||||||
126 | afd-gottschalk.de | Kay Gottschalk | Mitglied des Deutschen Bundestages | 7 | 175 | 891 | 40 | 2026-09-30 |
127 | alice-weidel.de | Alice Weidel - AfD Kanzlerkandidatin 2025 | 2 | 0 | 658 | 0 | 2026-06-29 |
128 | bernd-schattner.de | Bernd Schattner | 10 | 0 | 99 | 60 | 2026-09-22 |
129 | daniel-roi.de | Daniel Roi | 8 | 209 | 133 | 35 | 2026-10-01 |
130 | horst-foerster.de | Horst Förster, MdL | 6 | 45 | 136 | 14 | 2026-09-28 |
131 | kay-uwe-ziegler.de | Kay-Uwe Ziegler, Mitglied des Deutschen Bundestages | 4 | 264 | 283 | 21 | 2026-09-30 |
132 | richard-graupner.de | Richard Graupner, MdL | 7 | 30 | 812 | 17 | 2026-10-01 |
133 | ruben-rupp.de | Ruben Rupp - Ihr Landtagsabgeordneter im Wahlkreis Schwäbisc | 26 | 206 | 656 | 0 | 2024-12-01 |
134 | thomas-roeckemann.de | Abgeordneter Thomas Röckemann | 7 | 780 | 382 | 2 | 2026-10-04 |
135 | wolfgang-wiehle.de | Wolfgang Wiehle | 11 | 19 | 241 | 0 | 2026-10-03 |
Not a party site | |||||||
136 | alternita.de | Alternita | 5 | 0 | 21 | 65 | 2026-09-30 |
137 | bestellung.alternita.de | bestellung.alternita.de | 5 | 0 | 4 | 0 | 2025-06-24 |
138 | die-demokraten-trier.de | Die Demokraten im Stadtrat Trier | 8 | 29 | 191 | 23 | 2026-09-30 |
139 | ngofakten.de | NGO Fakten | 5 | 0 | 38 | 0 | 2026-06-03 |
B2 · What is in the website data?
A WordPress site keeps everything in database tables. The ones that matter, counted as distinct records (many sites were exported twice; counting rows would double-count):what | records (138 sites) | on how many sites | www.afd.de (later copy) |
---|---|---|---|
site accounts (admins, editors: name, email, password hash) | 5,375 | 137 | 7 |
form submissions (contact, membership, donation, volunteer forms: names, emails, phones, addresses) | 62,318 + 3,031 Elementor | 119 | 138,049 |
reader comments (name, email, IP) | 2,697 | 95 | 0 |
published articles & pages | 64,352 | 140 | 5,214 |
all posts entries (incl. drafts, revisions, uploads, plugin records) | 319,148 | 140 | 47,972 |
copies of emails the site sent (postman_sent_mail ) | 20,297 | 110 | 250 |
admin activity log (who did what, with IP) | 2,007,088 | 124 | 0 |
src/analysis/wordpress.py
and count distinct
(site, table prefix, id). DATA.md's figures for the same tables are mostly 2–13% lower (e.g. 282,734 posts
entries, 59,446 form submissions; comments are the exception, 2,708). No script for them exists in the repository, so the
difference can't be traced. The sent-mail count matches exactly (20,047 on 109 sites) when the nine
small 4–11-file site captures are left out, so DATA.md likely excluded some of those.State associations (Bavaria, Saxony-Anhalt, Thuringia) and the party newspaper AfD Kompakt hold the most submissions;
in.afdbayern.de
(by its name, the Bavarian party's internal site) has by far the most accounts (477). The admin log column shows that many sites recorded every admin login and edit, with IP address. Sent-mail logs stop at exactly 250 on most sites: the logging plugin keeps only the latest ones.The curve is flat (a few hundred to a few thousand a month) except for bursts: single days on which
one form received 500+ submissions. There are 11 such days, holding 42,166
submissions (21% of all since 2017). The two big ones are on www.afd.de, where a normal day
brings 20–150 submissions.
What they are can't be told from these tables: a bot flood, a mass import or a coordinated campaign all look the
same. The IP addresses don't settle it for www.afd.de, which records only a handful of distinct IPs on every day
(probably a proxy). On sites that record real visitor IPs, bursts from 1–3 IPs (e.g. afd-lsa.de, afdbayern.de) are
most likely automated. Either way, form submissions are not the same as people.
The biggest bursts
site | form id | date | submissions | distinct IPs that day |
---|---|---|---|---|
afd.de | 84 | 2022-11-02 | 14,927 | 4 |
afd.de | 33 | 2023-12-11 | 13,496 | 1 |
afd.de | 33 | 2023-12-10 | 5,239 | 1 |
afd-lsa.de | 3 | 2023-05-03 | 1,855 | 3 |
afdbayern.de | 6 | 2024-01-09 | 1,833 | 3 |
afd.de | 84 | 2022-11-04 | 1,200 | 2 |
afdkompakt.de | 2 | 2020-06-27 | 1,077 | 2 |
afdkompakt.de | 2 | 2020-06-26 | 700 | 2 |
afd.de | 115 | 2023-11-05 | 637 | 1 |
afd.de | 53 | 2018-11-23 | 631 | 2 |
afd.de | 53 | 2018-11-22 | 571 | 2 |
Most databases were copied in September/October 2026. The newest entry in each database shows
this: a copy can't contain entries made after it was taken. For 106 of 138 sites the newest entry is
from September or October 2026, so these databases were copied in those weeks, the last one on 5 October 2026.
The other sites have an older newest entry. That doesn't necessarily mean they were copied earlier: either
nothing happened on the site for a while, or the copy came from an older backup. For comparison, the newest
email in the archive is from 14 September 2026.
B3 · How did the source process the data?
The source didn't just copy databases. Much of the archive is their own work: working queues, AI scores, tool output, and lists that re-sort the personal data into ready-to-use form. The flow below shows the archive by size: each folder, then what kind of material it holds. "Made by the source" is everything produced about the data rather than taken from a system.Blue = original data taken from a system (290 GB, 98,917 files). Orange = made by the source, including some mixed working folders that also hold copied server files (11.0 GB, 2,050 files). Grey = public API snapshots and a public password list. By size the source's material is small next to the email, but by file count it isn't, and it includes the lists that matter most for privacy.
What the source built on top of the website databases (grouping by file name; counts inside the
files are the source's, from DATA.md):
- Ready-made personal-data lists. 119
*.gf_named.tsv
files match every form answer to its field label and class (email, first/last name, phone, city, member number, birth date). 226 more TSVs sweep every table of every site for anything that looks like personal data (362,398 rows, mostly noise).000072_inf6_identities.tsv
lists 6.65 million identifiers (IPs, emails, phones). For www.afd.de, a separate bundle in02_DATABASES/
holds extracted emails (86,237), phone numbers, names and addresses. - Triage. Keyword searches, category labels such as
cat_illegal_activity
, reading queues (MAIL_QUEUE_V2.tsv
, 2.7 GB) and language-model scores. The briefing's "key findings" come from here: ~263,000 keyword-ranked records → 490 scored by a model → 136 rated high/critical → hand-checked sample. - Records of the access. Probe results, download lists, credential-reuse tests and a ledger of server access.
Notes
- I analysed the data to the best of my knowledge and belief.
- Also to the best of my knowledge and belief, I removed data about private persons from the results shown here.
- I used AI for the analysis. Only models running locally on my own machine saw the source data. Models from other providers were used to generate code.
- The code to reproduce every step of this page is in the repository github.com/erikgoldenstein/afd-emails
(instructions in
REPRODUCE.md
). The repository is currently offline and will be published once it is legally clear that this is permitted. - An analysis of the emails' contents already exists. It too will only be published once there is more legal clarity.
- Contact: afd-emails@erik.gdn