mapping out the afd email leak

laying out the land of the oct 2026 dataset dump

abstract: a survey of the afd archive published at hexane.cc on 19 october 2026: about 421,000 emails from ten afd mailboxes (2013 to 2026) and the databases of about 140 afd websites. it shows how much is in it and which systems and years it comes from. it does not judge the contents.
notice: this blogpost is a static version of a marimo notebook. it therefore slightly differs from the usual styling of this blog.

Mapping out the AfD email data leak

On 19 October 2026 someone published an archive at hexane.cc. According to the people who published it, it was taken from the systems of the AfD, Germany's far-right party. It is about 300 GB in roughly 103,000 files:
  • Emails: about 421,000 emails from ten accounts on the party's mail servers, March 2013 to September 2026. Among them are the federal arbitration court, the federal and the NRW party office, Alexander Gauland, Fabian Jacobi, Leif-Erik Holm and two accounts of the party's merchandise shop;
  • Websites: the WordPress databases of www.afd.de and about 140 other party websites, including what visitors typed into their forms;
  • Documents and images: about 49,000 PDFs and office files and 39,000 images, most of them email attachments;
  • The source's own material: passwords and keys, output of the tools used for the break-in, and keyword searches and AI-rated "findings" made from the data.
The website hexane.cc itself shows no emails, only AI-generated summaries sorted into categories such as racism and antisemitism. According to the attackers, they got in through a single unpatched party website (Security Affairs). The AfD confirmed the attack the next day: a hosting provider of the party was attacked in September 2026, and parts of ten mailboxes, most of them unused for years, were "unlawfully copied". Current accounts of the federal party were reportedly not affected (The Local, citing Bild). The party called it an "attack on the German party system and therefore on democracy", but won't say whether the published contents are genuine (CORRECTIV). Bild checked a sample and found ID copies, invoices, bank statements and membership lists that appear genuine (The Local). CORRECTIV published first findings on election strategy, lists used to screen members and contacts with Russia. Security researcher Lilith Wittmann considers the leak genuine and the reported entry point plausible (Security Affairs). Handelsblatt and nd (dpa) report that the authenticity is unclear. These assessments do not confirm individual emails. The archive itself provides no proof of where or when it was taken. A7 shows how far the emails can be checked technically. This analysis describes the archive: how much is in it, from which systems and which years, and why counts that seem to measure the same thing disagree. It does not assess the contents. The emails and the websites are two independent datasets from different systems; they share only the occasional email address. Every number is computed here from the files, unless it is marked as reported by the source. Those figures come from the notes of the person or group who provided the data, referred to below as the source. Read top to bottom. Each section starts with a short answer, then the evidence.

Part A: the emails

A1 · How many emails?

emails
421,178
stored messages, all folders
conversations
49,554
threads with 2+ emails
email addresses
93,635
in any header
time span
2013–2026
Mar 2013 to Sep 2026, by send date
Short answer: 421,178 emails. Duplicate copies were largely removed before release. According to DATA_DICTIONARY.md, the source used each message's identifier, its Message-ID, to remove duplicates. The check supports this. Only 42 emails share a Message-ID with another one, and 81 have none. When two mailboxes held the same email, usually only one copy survived, in one of the folders. (That matters in A2.) The latest email is dated 14 September 2026. The website data (Part B) reaches about three weeks further.
The mailboxes cover very different windows: Gauland's runs 2017–2023, bundesgeschaeftsstelle@ stops in early 2018, and the hyphenated Holm folder covers just two weeks (A6). The 2016–2018 peak is mostly the bundesschiedsgericht@ folder, which holds far more than the arbitration court's mail (A2). An empty cell means the archive has no emails from that folder for that year.

A2 · Why counting per mailbox and per address gives very different numbers

Emails can be counted per mailbox or per address. The folder bundesschiedsgericht@ holds 101,078 emails. That same address appears in To/Cc/Bcc on only 8,800 emails in the archive. Both counts are correct. They answer different questions:
countquestion it answers
per mailboxIn which folder of the archive is an email stored?
per addressHow often is an address written in an email's From/To/Cc/Bcc line, anywhere in the archive?
They would only match if every email in a folder were visibly from or to that folder's address. That is not the case here. An email can reach a mailbox via Bcc, a mailing list, an alias or a forwarding rule, without that address appearing among the visible recipients. A folder can also hold other people's mail. The receiving mail server can record the true recipient in a header field called Delivered-To, which shows what happened:
Three folders show the effect clearly:
  • Gauland: 32,615 emails stored. His address is in To/Cc only 13,167 times. The per-address "received" count is 14,482, because it also includes mentions in other folders. Yet the server recorded him as the real recipient on 32,600 (100%). Most of his mail reached him as Bcc, via lists or aliases. He sent only 15 of them himself; the folder is almost entirely an inbox.
  • bundesschiedsgericht@ (federal arbitration court): 101,078 emails, but only 14,311 (14%) name that address as sender, recipient or delivery address. The folder mostly holds other people's mail: the flow chart below shows Alice Weidel's, paypal@, Magnus Heutmann's and others. The folder name only says where the source filed the mail.
  • leif.erik.holm@ (dotted): 60,215 emails, and the dotted address appears in none of them (0). It is the mail of leif-erik.holm@ (hyphen), the MV party office buero@afd-mv.de, the press office and others.
To find out how much mail is in a folder, count per mailbox. To find out how much a person wrote or received, count by address, ideally together with the delivery headers. A person can have several addresses (Jacobi has three).
Green links: delivered to the address the folder is named after. Violet: delivered to someone else. Grey: no delivery header (the server didn't record one) or less frequent recipients folded into other. Hover a link for its count.

A3 · How many email threads?

A thread here is a set of emails linked through the Message-IDs they cite in their In-Reply-To/References headers (threads/ in the corpus). A shared subject line is not used to link messages. The headline number depends on what you call a thread:
  • 300,807 threads if every unanswered email counts as its own thread.
  • 49,554 conversations if a thread needs at least two emails. These hold 169,925 emails (40% of all).
84% of threads are a single email: newsletters, notifications, spam, one-off messages nobody answered, or replies whose predecessor isn't in the archive.Two signs that the mailboxes are incomplete: 63,718 threads (21%) cite at least one earlier email that is not in the archive (98,919 missing emails in total, e.g. the sent copy of a reply). And only 9,111 threads span more than one mailbox folder, partly because of the Message-ID deduplication (A1).

A4 · Who sends the emails?

Short answer: about half of all email comes from the AfD (53%): party offices, officials and party systems, from only 2,785 addresses. Private persons come next (18%), from by far the most addresses (17,247). Companies account for 15%: printers, merch suppliers, IT, lawyers and associations. Automated mail accounts for 10%; PayPal alone sends 22,000. Politics & state outside the AfD domains is small (2%), mostly @bundestag.de. Spam is 8,618 emails (2%), sent from almost as many distinct addresses.
Each email gets one category from its sender address. The rules are applied in order (first match wins). They live in src/metadata_analysis/senders.py:
#categoryrule
0No sender addressthe From header has no parsable address
1Spamany of the four indicators below
2AfDa party domain (afd…, alternativefuer…, party shop/hosting)
3Politics & stateparliaments (Bundestag, Landtage, EU), other parties, government, police, courts, city administrations
4Automated & newslettersauto-reply or mailing-list headers, no-reply/newsletter-style addresses, platforms (PayPal, Twitter, Amazon, …)
5Private personsa freemail provider (gmail, web.de, gmx, t-online, …): individuals writing from a personal account
6Companies & orgseverything else: a sender with its own non-party domain (businesses, associations, media, law firms)
The spam rule covers four indicators: the server's assessment, a spam-tagged subject, a domain ending often used for spam (.su, .mom, .makeup, …), or constantly changing senders. For the last indicator, a domain must send at least 10 emails, with at least 80% coming from a different address each time. The category only describes the address. An AfD MP writing from @bundestag.de counts under Politics & state, one writing from gmail under Private persons.

Spam: the server's flag vs. these rules

The mail server does set a spam flag (X-Spam-Flag, plus X-Spam-Score). On its own it can't tell how much is spam, because most emails have no verdict at all: they passed through servers that didn't add one. Where a verdict exists, it can be used to check the rules above:
  • 51,998 of 421,178 emails (12%) carry a server verdict: 1,227 YES, 50,771 NO. Coverage depends on the mail server: 100% for the hyphenated Holm folder, under 1% for bundesschiedsgericht@.
  • For this comparison, the server verdict is left out. The other rules still catch 815 of the 1,227 server-YES emails (66%).
  • They also call 2,036 server-NO emails spam (4% of them). A random sample (below) shows that these are spam the server missed.
  • On the 369,180 emails with no verdict, the rules find 5,324 spam.
So the count of 8,618 spam emails is a conservative estimate: the server flag alone gives a floor of 1,227, and without that flag the other rules miss about a third of server-flagged spam, so the true figure is likely somewhat higher. At about 2% of all emails, spam hardly changes the other numbers.
Random sample: server said NO, rules say spam
subject (server said: not spam)rule
Bringt dem Herz und den Gefäßen ihre Gesundheit zurückdomain ending often used for spam
Sicherer Gewichtsverlust: Brennen Sie bis zu 30 Kilo nach einer Kurdomain ending often used for spam
Effektive Behandlung von Hamorrhoiden in jedem Stadiumdomain ending often used for spam
Vollstandige Haarwiederherstellung in 28 Tagendomain ending often used for spam
Keramin - Entfernt alle Papillome und Warzendomain ending often used for spam
Wie man Diabetes schnell und richtig behandeltdomain ending often used for spam
Sicherer Gewichtsverlust: Brennen Sie bis zu 30 Kilo nach einer Kurdomain ending often used for spam
Dr.Derm - Gesunde und problemlose Hautdomain ending often used for spam
Jetzt sofort und ohne Stress wieder frische Finanzmittel bekommendomain ending often used for spam
Effektive Behandlung von Hamorrhoiden in jedem Stadiumdomain ending often used for spam
Hochdosierte Kombination aus Fettverbrenner und Kohlehydratblocker.constantly changing sender addresses
Sicherer Gewichtsverlust: Brennen Sie bis zu 30 Kilo nach einer Kurdomain ending often used for spam
12 rows

AfD and politics & state: who exactly?

Left (blue): the AfD. 221,769 emails come from party addresses, spread over 428 domains (the part of an address after the @) and 2,785 addresses. The chart shows the 10 domains that sent the most emails. Each bar is one domain. Its length and the number at its end give how many emails from addresses at that domain are in the ten mailboxes. Together these 10 domains account for 85% of all AfD emails. Right (orange): politics & state, meaning parliaments, other parties, government, courts and police (8,770 emails), split by kind of sender. Here too, the number at each bar is the number of emails.Bundestag mail (7,068 emails from 155 addresses) is concentrated: 90% comes from 15 addresses. They belong to the AfD MPs markus.frohnmaier, leif-erik.holm, beatrix.vonstorch, enrico.komning, alice.weidel, michael.espendiller, anton.friesen and their staff, whose addresses carry the suffix .maNN. Most of Politics & state is therefore AfD people writing from parliamentary accounts. Other parties barely appear as senders.
Each bar splits a category's sender addresses by how many emails each one sent. Private persons mostly write once: 13,199 of 17,247 private addresses (77%) sent exactly one email, typically members of the public writing to the party. The AfD has few addresses, and each of them sends many emails. Almost every spam address sent a single email.

A5 · What does it look like as a network?

Every address is a node. An edge goes from a sender to each address in To/Cc/Bcc, weighted by the number of emails.
addresses that sent or received
77,610
sender → recipient pairs
294,621
in one connected cluster
86%
66,512 addresses
pairs that wrote both ways
13%
Short answer: 86% of addresses form one connected cluster, held together by a handful of party addresses that mail hundreds or thousands of others. Most edges are one-directional: only 13% of sender→recipient pairs exchanged mail in both directions. The other 5,087 small clusters are mostly isolated pairs (4,415 of them): one outside address and one recipient that never connect to anyone else.
Read a row as this kind of sender, a column as writes to this kind of recipient. A delivery is one (email, recipient) pair, so one email to 100 recipients counts 100 times. Mass mailers therefore weigh heavily:
  • AfD → AfD is the biggest block: internal mail and party mailing lists.
  • Private persons → Politics (10% of all deliveries) is mostly people mailing whole parliaments: the 10 busiest private senders account for 34% of it, and 25% of all deliveries by private senders.
  • Companies also send mass mail: the largest single sender in the archive, musik-baron.de, sent ~1,900 emails to ~100 recipients each (party addresses, MPs, media).
Emails in both directions show that an exchange took place. Only a minority of private persons and companies ever got a reply in the archive. (Replies sent from addresses or mailboxes outside the archive are invisible here, so this is a lower bound.)
Two clusters dominate. On one side NRW (state office, arbitration court, Jacobi's three addresses, the state board), linked to the MV office (7, 16) and the fan shop (5, 6). On the other side is the federal party around Gauland and Weidel (17, 11), surrounded by private and company mass mailers who write to them and to MPs of all parties (the large green dot, no. 1, is one such sender). Not shown: PayPal's notifications to paypal@alternativefuer.de, which form a separate island. Private persons are not named: they are listed by their mail provider only. Those writing from their own domain appear as own domain, without naming the domain. The sender rules count such domains as companies; here they are shown as private persons.

A6 · Unusual structures

Features of the email data that are easy to misread:
  1. Two Holm mailboxes; the larger folder's address appears nowhere. The dotted leif.erik.holm@afd-mv.de folder holds 60,215 emails from 2019 to 2026, but that spelling appears in no header of any email in the archive. The real address is the hyphenated leif-erik.holm@, whose own folder holds just 247 emails from 25 Dec 2022 to 9 Jan 2023, covering two weeks. The source's briefing lists only the hyphenated address.
  2. Folders named after one address hold others' mail. bundesschiedsgericht@ is mostly Alice Weidel's, paypal@'s and Magnus Heutmann's mail (A2). A folder name only says where the source filed the mail.
  3. unknown/ contains mail of known accounts. Its 7,237 emails have no folder owner, but where a delivery header exists it names real accounts: bundesgeschaeftsstelle@alternativefuer.de (1,147), fabian.jacobi@afd.nrw (342), buero@afd-mv.de (245).
  4. Inboxes vs. sent mail differ per folder. The address the folder is named after sent 0% of the emails in alexander.gauland@ but 68% in bundesgeschaeftsstelle@. Gauland's folder is almost entirely an inbox (15 sent emails in six years). Questions like "how often did X reply" can only be answered where sent mail is in the archive.
  5. sebastian.lux@ effectively stops in 2021. 31,817 of its 32,020 emails are from before 2022, then only 203 trickle in until 2026.
  6. Whether delivery headers exist depends on the server. The share ranges from 0% of emails (sebastian.lux@) to 100% (leif-erik.holm@). Where they're missing, Bcc and list recipients are invisible.
  7. Mass mail. 31,750 emails have the exact same text as another email (newsletters, notifications, mailings sent one recipient at a time), though each has its own Message-ID.
  8. Addresses appearing only in Reply-To. 14,774 of the 93,635 addresses appear only in a Reply-To header, typically web forms and newsletters ("reply to this person, not to me"). So the archive has 93,635 addresses overall, but only 78,861 of them as senders or recipients.

A7 · How complete and how authentic are the emails?

Two checks on the quality of the data. First: how many emails have no readable text? Second: are the emails still exactly as they were sent? For many emails this can be checked through their DKIM signature (explained further down). The DKIM results come from uv run verify-dkim (see src/metadata_analysis/REPRODUCE.md).
4,283 emails (1.0%) have no readable text. Most of them are not broken: 3,513 consist only of attachments (a PDF, a scan, a calendar invitation), 281 are automatic read receipts, and in 230 Outlook packed the text into a winmail.dat attachment. 132 have an HTML part without any text (typically a newsletter made of images), 67 are encrypted, and only 60 are completely empty. No folder stands out: the share lies between 0.2% and 2.0% (schiedsgericht@). These emails still count in every number that is based on headers.
What is DKIM? A digital signature that the sender's mail server attaches to an email when sending it; if the text or one of the signed headers (such as sender, subject or date) is changed afterwards, the signature no longer matches.100,929 emails (24%) carry a DKIM signature. The share varies by year, from 11% (2018) to 44% (2026). (56 emails could not be parsed by the verifier; they count as unsigned.) What the signatures say today:
  • 27,120 verify completely: text, headers and the sender's key, which is still published.
  • 7,628 are mathematically intact, but expired or made with the outdated SHA-1.
  • 20,993 have an unchanged text, but the sender's domain no longer publishes the key, so the header part can't be checked. That is normal for old mail: keys get replaced.
  • 11,204 have an unchanged text, but the header check fails. Either a header line was changed on the way (mail gateways tag subjects, for example), or the domain has since published a new key under the same name.
  • 33,805 have a text that no longer matches what the sender signed. This check needs no key, so it is reliable for old mail too.
A broken signature doesn't prove a forgery. An intact one only shows that the text is what the sending server signed; whether the content is true is a separate question.
Were emails edited? The changed texts follow a technical pattern. 31,690 of the 33,805 emails with a changed text (94%) are in one folder, bundesschiedsgericht@. There, 92% of all signed emails from Feb 2015 to 17 September 2019 are affected, from every kind of sender (PayPal receipts, Gmail, Twitter …). Then it stops from one day to the next: of the 1,397 signed emails after that date, 1 is affected. The folder's volume drops sharply at the same time. In all other folders, 3.3% of the signed emails have a changed text, with no comparable cluster. Hand edits would affect a few selected emails; here almost every PayPal receipt of a month is affected. The pattern fits software that re-encoded the stored emails, for example when the mailbox was moved to another system. A separate check of 200 changed and 200 intact emails from this folder (not part of this analysis) supports that: 171 of the changed ones contain base64 blocks, sections of encoded text wrapped uniformly at 76 characters, compared with 85 of the intact ones. In the same check, appended or prepended text, line endings and mbox >From quoting explained none of the changes.

Part B: the website data

B0 · Where does it come from, and did the websites lead to the mail?

Two accounts can be checked against each other here: the archive itself, and the reconstruction by Lilith Wittmann and Hoodinformatik ("Zweimal gehackt", 20 October 2026), which rests on statements from the hackers and from people close to the hosting provider. What the article says happened: an insecure WordPress site, wahlkampf.afd.de, was the entry point. A plugin (WP-Console) provided a command line on the server. From there, the attackers reached the mail administration. They changed the passwords of party officials' mailboxes and downloaded the mail over IMAP. A first run was noticed on 9 September (about 180 GB). A second was stopped around 6 a.m. on 14 September, after about 300 GB in all. The systems belong to Alternita Dienstleistungs GmbH, the party's own service company, which runs hosting for many state and local associations. What the archive itself shows: 04_TABULAR_DATA/000428_raw_console.jsonl is a log of 201 shell commands from 12 September, run with the rights of the wahlkampf.afd.de website, inside that site's folder. The commands and their output contain working passwords and API keys, so the analysis only shows when each command ran and what kind of step it was (read off the command, see src/metadata_analysis/access.py).
Read from the outputs of the same log:
  • Passwords from the web server. The configuration files of every site on the machine are read, including database passwords.
  • The mail-management system answers. The internal app behind mail-management.afd.de is read from disk. Access through its programming interface (API) is initially refused (HTTP 401). With a key found in the code, it then returns data (HTTP 200). Around 16:30 a list of all mail users (≈0.9 MB) is downloaded and turned into a mailbox table. The archive's mailbox-management table (000678_mm_mailboxes.tsv) is the same kind of record.
  • Mail-server logins work for a system account (no-reply@…) on three mail hosts.
  • The direct route fails. For two hours there are attempts to mount the mail storage (NFS_…_MAIL_BACKEND) from the web server; every attempt is refused.
  • Not visible in this log: the WP-Console plugin (it is also not among the site's active plugins in its exported settings), and the changing of mailbox passwords. Both may have happened outside this one session, which covers only 201 commands on one afternoon.
A second record helps check the time given in the article. The archive also holds the mailbox table of the mail-management system (000678_mm_mailboxes.tsv, 2,219 mailboxes). The password column is not read here. It shows 6 new mailboxes on 14 September between 04:24 and 04:27 UTC (06:24–06:27 German time), each noted as "Backup-Account von …@afd.nrw". One of them is the backup of fabian.jacobi@afd.nrw, whose mailbox is in the archive. The table doesn't say who created them, or why. The timing fits the article's "detected around 6 a.m.". The table's newest change is from 08:47 UTC that morning, so this copy was made after the detection. Password changes, checked: 9 of the leaked mailbox folders appear in this table. The dotted leif.erik.holm@ is absent: it is not a separate mailbox, which fits A2. Only 1 mailbox entries have their latest update in September 2026, after detection: schiedsgericht@afd.nrw on 14 Sep at 05:24 UTC. So for the other mailboxes this system shows no password change. The table records only the latest update to a mailbox entry, though: earlier changes may have been overwritten, and changes made in other ways cannot be ruled out.
How article and archive fit together:
Claim in the articleWhat the archive says
The way in was the WordPress site wahlkampf.afd.deSupported. The shell log runs as that site's user, in its folder.
WP-Console gave the command lineNot shown. Neither the shell log nor the site's exported settings name it.
From there into the mail administrationSupported. The log reads the mail-management app and pulls the full user list through its API.
Mailbox passwords were changed, mail downloaded over IMAPIMAP plausible, password changes not seen. IMAP logins work in the log; the mail-management table shows no September change on the mailboxes in the archive before the detection (see above).
First run noticed on 9 SeptNot confirmed. No email in the corpus mentions an incident. The only notice is planned "further server work" on the party's member system for 14–15 Sept, announced on 10 Sept; that may or may not be related.
Access kept after the first runConsistent. The shell session was on 12 Sept, and the newest emails in the mailboxes are from 11 to 14 Sept.
Second run detected around 6 a.m. on 14 SeptSupported. 6 "Backup-Account" mailboxes appear between 06:24 and 06:27 German time. The newest emails are from 08:29 and 09:04 German time, so mail still arrived, or was still copied, after that.
≈300 GB in totalMatches the publication. The archive is 302 GB, of which 225 GB is email; the rest is website databases, documents and images. The split into 180 GB and 120 GB can't be checked: the source's upload records only cover the three oldest mailboxes.
The same mailboxes were copied twiceConsistent. Only 42 emails share a Message-ID, so duplicate copies were largely removed before publishing. This does not confirm how often the mailboxes were copied.
AfD: mainly older mailboxesPartly. Three folders end before September 2026 (Gauland 2023, Bundesgeschäftsstelle 2018, the hyphenated Holm address 2023), but the large ones reach into September 2026.
Access to ≈300 mailboxes, largest firstCannot be checked. The archive holds 10 named mailbox folders, a small, large-volume selection out of the 2,219 the mail-management system lists. This does not establish how many were accessible.
Alternita runs 300+ domainsNot comparable. That counts domains (the mail system alone lists 500); B1 counts the WordPress databases that were exported.
Beyond the mail, the source's work files record further website access: database logins with credentials from site configuration files (wp-config) and backups, and a self-made single-sign-on token that, by their own record, gave admin access on afd-fraktion-hessen.de (000264_SERVER_ACCESS_LEDGER.tsv). wahlkampf.afd.de and alternita.de are both among the exported sites; Alternita also appears as the operator of an order system (bestellung.alternita.de) and as admin accounts named alternita_* on party sites.

B1 · How many websites leaked, and which domains?

Short answer: 139 websites: www.afd.de plus 138 other party-related sites. The file names suggest 140 other sites. Here is how the adjusted count is reached:
  • 04_TABULAR_DATA/ holds table exports under 142 different export names.
  • One of them (h4_route_samples) isn't a website (output of one of the source's tools).
  • One (afd_de) is a later copy of www.afd.de, whose main database is in 02_DATABASES/.
  • That leaves 140 export names (the "140 other websites"). Each site's own siteurl setting shows that two pairs are the same site: afd-dessau-rosslau_de, afd_dessau_rosslau_de, ruben-rupp_de, test-micro_afd_de (afd-dessau-rosslau.de, ruben-rupp.de). test-micro.afd.de is a staging copy of ruben-rupp.de. So there are 138 distinct domains, plus www.afd.de.
Every domain below is read from the site's own database (siteurl setting), not guessed from the file name. The site types are this analysis's own grouping, read off the domain.
All 139 leaked websites (one row per distinct domain, grouped by site type; counts are distinct records in the leaked database, as in B2). Scroll the list; links open the live site.
#domainsite title (its own setting)accountsform entriesposts & pagescommentsnewest entry
National party, campaigns & media
1afd.deAlternative für Deutschland7138,0495,21402026-10-04
2afdkompakt.deAfD Kompakt185,08012,16602026-09-29
3bilddatenbank.afd.debilddatenbank.afd.de20202026-09-29
4gemeinsam-fuer-das-grundgesetz.deGemeinsam für das Grundgesetz602002025-07-07
5generationdeutschland.deGeneration Deutschland853902026-08-28
6mitmachen.afd.deMitmachen in der AfD401602026-09-29
7sachsen-anhalt.afd.deAfD Sachsen-Anhalt00902025-05-13
8spenden.afd.deAfD Spenden40902026-09-29
9wahlkampf.afd.deWahlkampfportal der AfD603902025-12-10
State association
10afd-brandenburg.deAfD Brandenburg7024872026-09-03
11afd-frauen.nrwFrauen in der AfD401232026-09-29
12afd-lsa.deAfD Sachsen-Anhalt98,57328802025-10-17
13afd-mv.deAlternative für Deutschland Mecklenburg-Vorpommern111,5484,36732026-10-05
14afd-thueringen.deAfD Thüringen393,5124,819792026-10-03
15afd.berlinAfD Landesverband Berlin105466002026-10-02
16afd.nrwAfD NRW91,1062,11882026-10-03
17afd.saarlandAfD Saarland51,23781142026-10-03
18afdbayern.deAfD Bayern169,4851,62542026-10-04
19alternative-rlp.deAfD Rheinland-Pfalz896975142026-01-02
20in.afdbayern.deBayern intern47755636002026-09-09
21plakatshop.afdbayern.deAfD Bayern Plakatshop660181092026-09-29
22russlanddeutsche-afd.nrwRusslanddeutsche für die AfD NRW64161,19432026-08-24
Regional association
23afd-bezirk-arnsberg.deAfD Bezirk Arnsberg835275532026-09-15
24afd-bezirk-duesseldorf.deAfD Bezirk Düsseldorf92159502024-08-09
25afd-bezirk-muenster.deAfD Bezirk Münster919563152026-09-24
26afd-bezirk-owl.deAfD Bezirk Ostwestfalen-Lippe9223457182026-09-29
27afd-oberbayern.deAFD Oberbayern | Bezirksverband Oberbayern | Alternative für789102192026-09-30
Local chapter
28afd-anhalt-bitterfeld.deAfD Kreisverband Anhalt-Bitterfeld10439173242026-10-01
29afd-aw.deAfD Ahrweiler1016156402026-09-30
30afd-bad-kissingen.deAfD Bad Kissingen5742002026-10-02
31afd-bgl.deAfD Berchtesgadener Land7012662026-09-04
32afd-bielefeld.deAfD Kreis Bielefeld171333,23742026-10-03
33afd-bottrop.deAfD Kreis Bottrop10370194452026-10-04
34afd-dessau-rosslau.deAfD Kreis Dessau-Roßlau Stadt8296619152026-01-07
35afd-dortmund.deAfD Kreis Dortmund8787543502026-10-02
36afd-duisburg.deAfD Kreisverband Duisburg670895272026-09-29
37afd-ennepe-ruhr.deAfD - Kreisverband Ennepe-Ruhr54121502026-09-30
38afd-essen.deAfD Kreis Essen4707297522026-09-08
39afd-euskirchen.deAfD Kreis Euskirchen74834732026-06-10
40afd-hagen.deAfD Kreisverband Hagen7272230462026-09-23
41afd-harzkreis.deAfD Kreisverband Harz81352412026-09-10
42afd-hassberge.deAfD Haßberge / Rhön-Grabfeld7712002026-09-30
43afd-herford.deAfD Kreis Herford8204500282026-10-05
44afd-hochsauerlandkreis.deAfD Hochsauerlandkreis71215892026-10-04
45afd-hro.deAfD Hansestadt Rostock91112302026-09-18
46afd-iserlohn.deAfD Fraktion im Stadtrat Iserlohn52624632025-12-01
47afd-kelheim.deAfD Kreisverband Kelheim445502026-10-04
48afd-krefeld.deAfD Kreis Krefeld1042314392026-10-05
49afd-kreis-borken.deAfD Kreis Borken7350189132026-09-29
50afd-kreis-coesfeld.deAfD Kreis Coesfeld925819992026-09-29
51afd-kreis-duesseldorf.deAfD Kreis Düsseldorf8625248322025-10-10
52afd-kreis-hamm.deAfD Kreis Hamm748416072026-10-04
53afd-kreis-olpe.deAfD Kreis Olpe94415352026-09-30
54afd-kreis-recklinghausen.deAfD Kreis Recklinghausen96861,3921042026-09-30
55afd-kreis-wesel.deAfD Kreisverband Wesel5551283612026-05-21
56afd-kreisverband-rottal-inn.deAfD Kreisverband Rottal-Inn004702026-10-03
57afd-landsberg-lech.deAfd Landsberg Lech8852372026-09-30
58afd-lichtenfels.deAFD Kreisverband Lichtenfels9755502026-09-30
59afd-main-spessart.deAfD Kreisverband Main-Spessart6891502026-09-30
60afd-mettmann.deAfD Kreis Mettmann135811,319182025-08-18
61afd-minden-luebbecke.deAfD Kreisverband Minden-Lübbecke5519426452026-10-03
62afd-moenchengladbach.deAfD Kreis Mönchengladbach126663902025-12-03
63afd-mse.deAfD Kreisverband Mecklenburgische Seenplatte6575185142026-10-01
64afd-muelheim.deAfD Kreis Mülheim10672343322026-10-04
65afd-muenchen-land.deKreisverband München Land67815512026-10-02
66afd-muenchen-ost.deAfD Kreis München Ost710812242026-02-20
67afd-muenchen.deAfD München1814391702026-10-01
68afd-muenster.deAfD Kreisverband Münster87941,109522026-09-29
69afd-neuburg-schrobenhausen.deAfD Kreis ND-SOB1,9322931602026-09-30
70afd-nwm.deAfD Kreisverband Nordwestmecklenburg9273102026-09-29
71afd-oberberg.deAfD Kreisverband Oberberg1,8164988632882026-10-04
72afd-oberhausen.deAfD Oberhausen73111,14822026-10-04
73afd-passau.deAfD Kreisverband Passau7745532026-10-03
74afd-rhein-kreis-neuss.deAfD Rhein Kreis Neuss1437336902025-09-25
75afd-ro.deAfD Kreisverband Landkreis Rostock7557284122026-09-29
76afd-schwarzwald-baar.deAfD Kreisverband Schwarzwald-Baar82182002026-10-03
77afd-schweinfurt-land.deAfD Kreisverband Schweinfurt-Land54502026-09-30
78afd-siegen-wittgenstein.deAfD Kreis Siegen-Wittgenstein7489403172026-03-03
79afd-sn.deAfD Kreisverband Schwerin432617132026-06-25
80afd-swm.deAfD Kreis Südwestmecklenburg718136162026-07-05
81afd-trier.deAfD Kreisverband Trier626150102026-09-30
82afd-unterallgaeu-memmingen.deAfD Kreis Unterallgäu-Memmingen9255426372026-09-30
83afd-vg.deAfD Kreisverband Vorpommern-Greifswald72391,99902026-10-02
84afd-vr.deAfD Kreisverband Vorpommern-Rügen7383190262025-10-25
85afd-weiden.deAfD Weiden | Kreisverband52669602026-10-02
86afd-weilheim-schongau.deAfD Kreisverband78116302026-09-09
87afd-wuerzburg.deAfD Kreis Würzburg428453142026-09-30
88afd-wuppertal.deAfD Kreis Wuppertal5029122026-09-29
89afd.koelnAfD Köln131,402651162026-10-05
90afdosnabrueck.deAfD Kreisverband Osnabrück6368193302026-10-04
91afdsaarpfalz.deAfD Saarpfalz5391802026-09-30
92alternative-fuer-mk.deAfD Märkischer Kreis9816184162026-10-03
93kebst-blue.volker-heinecke.deKatrin Ebner-Steiner13366199582026-09-29
Berlin district
94friedrichshain-kreuzberg.afd.berlinAfD Bezirk Friedrichshain-Kreuzberg17182402026-08-31
95lichtenberg.afd.berlinAfD-Bezirksverband Lichtenberg91815302026-10-02
96marzahn-hellersdorf.afd.berlinAfD Bezirksverband Marzahn-Hellersdorf1018208702026-09-14
97mitte.afd.berlinAfD Bezirksverband Berlin Mitte9181202026-08-31
98neukoelln.afd.berlinAfD Bezirksverband Neukölln6184902026-08-25
99pankow.afd.berlinAfD Berlin-Pankow101,78280862026-10-02
100reinickendorf.afd.berlinAfD Bezirksverband Reinickendorf11181451102026-08-31
101spandau.afd.berlinAfD Bezirk Spandau81816482026-09-06
102steglitz-zehlendorf.afd.berlinAfD Steglitz-Zehlendorf12181302026-09-18
103tempelhof-schoeneberg.afd.berlinAfD Bezirksverband Tempelhof-Schöneberg11183302026-09-10
104treptow-koepenick.afd.berlinAfD Treptow-Köpenick81887182026-09-30
Parliamentary group
105afd-do-fraktion.deAktuelles627887122026-09-30
106afd-fraktion-duisburg.deAfD-Fraktion im Rat der Stadt Duisburg982360122026-10-04
107afd-fraktion-en.deAlternative für Deutschland, Kreistagsfraktion Ennepe-Ruhr62997172026-09-30
108afd-fraktion-hessen.deAfD-Fraktion Hessen99391,354142025-09-08
109afd-fraktion-luenen.deAfD Fraktion im Stadtrat Lünen9751151182026-09-30
110afd-fraktion-rkn.deAfD-Fraktion Rhein-Kreis Neuss6392622025-09-25
111afd-fraktion-siegen.deAfD-Ratsfraktion Siegen41585232026-09-30
112afd-fraktion-tk.deAfD Fraktion Treptow-Köpenick8375607452026-09-30
113afd-fraktion-vg.deAfD-Fraktion Vorpommern-Greifswald9228502026-09-30
114afd-fraktion-witten.deAlternative für Deutschland Ratsfraktion Witten5147118222026-10-02
115afd-fraktion-wuppertal.deAfD-Fraktion im Rat der Stadt Wuppertal8324892026-09-30
116afd-fraktion.koelnAfD-Fraktion im Rat der Stadt Köln7370814272026-10-01
117afd-fraktion.saarlandAfD Fraktion Saarlandes51054872026-10-03
118afd-im-roemer.deAfD-Fraktion im Römer7224918202026-09-30
119afd-kreistag-abi.deAfD im Kreistag Anhalt-Bitterfeld71144982026-09-30
120afd-kreistag-rostock.deAfD Fraktion - Bündnis Deutschland753165292026-09-30
121afd-kreistag-siwi.deAfD im Kreistag Siegen-Wittgenstein62267102026-09-30
122afd-kreistagsfraktion-hsk.deafd-kreistagsfraktion-hsk002902026-10-03
123afd-ratsfraktion-bottrop.deAfD-Ratsfraktion Bottrop97219102026-09-30
124afd-stadtrat-muenchen.deOffizielle Seite der AfD im Münchner Stadtrat.8045922026-09-30
125afd-stadtrat-trier.deDie Demokraten im Stadtrat Trier824145132026-03-16
Politician's own site
126afd-gottschalk.deKay Gottschalk | Mitglied des Deutschen Bundestages7175891402026-09-30
127alice-weidel.deAlice Weidel - AfD Kanzlerkandidatin 20252065802026-06-29
128bernd-schattner.deBernd Schattner10099602026-09-22
129daniel-roi.deDaniel Roi8209133352026-10-01
130horst-foerster.deHorst Förster, MdL645136142026-09-28
131kay-uwe-ziegler.deKay-Uwe Ziegler, Mitglied des Deutschen Bundestages4264283212026-09-30
132richard-graupner.deRichard Graupner, MdL730812172026-10-01
133ruben-rupp.deRuben Rupp - Ihr Landtagsabgeordneter im Wahlkreis Schwäbisc2620665602024-12-01
134thomas-roeckemann.deAbgeordneter Thomas Röckemann778038222026-10-04
135wolfgang-wiehle.deWolfgang Wiehle111924102026-10-03
Not a party site
136alternita.deAlternita5021652026-09-30
137bestellung.alternita.debestellung.alternita.de50402025-06-24
138die-demokraten-trier.deDie Demokraten im Stadtrat Trier829191232026-09-30
139ngofakten.deNGO Fakten503802026-06-03

B2 · What is in the website data?

A WordPress site keeps everything in database tables. The overview below counts distinct records in the main tables. Many sites were exported twice, so counting rows would double-count:
whatrecords (138 sites)on how many siteswww.afd.de (later copy)
site accounts (admins, editors: name, email, password hash)5,3751377
form submissions (contact, membership, donation, volunteer forms: names, emails, phones, addresses)62,318 + 3,031 Elementor119138,049
reader comments (name, email, IP)2,697950
published articles & pages64,3521405,214
all posts entries (incl. drafts, revisions, uploads, plugin records)319,14814047,972
copies of emails the site sent (postman_sent_mail)20,297110250
admin activity log (who did what, with IP)2,007,0881240
The personal data is in the forms. 200,367 form submissions, two thirds of them on www.afd.de, hold what visitors typed in: names, email addresses, phone numbers, postal addresses, sometimes dates of birth. Not every submission represents a distinct person; see the bursts below. Because these are party sites, a submission also hints at political sympathy. This is a special category of personal data under GDPR Art. 9. About the numbers: they come from src/metadata_analysis/wordpress.py and count distinct (site, table prefix, id), so a record that was exported several times counts once.
State associations (Bavaria, Saxony-Anhalt, Thuringia) and the party newspaper AfD Kompakt hold the most submissions; in.afdbayern.de (by its name, the Bavarian party's internal site) has by far the most accounts (477). The admin log column shows that many sites recorded every admin login and edit, with IP address. Sent-mail logs stop at exactly 250 on most sites: the logging plugin keeps only the latest ones.
The curve is flat (a few hundred to a few thousand a month) except for bursts: single days on which one form received 500+ submissions. There are 11 such days, holding 42,166 submissions (21% of all since 2017). The two big ones are on www.afd.de, where a normal day brings 20–150 submissions. The tables do not reveal what caused these bursts: a bot flood, a mass import or a coordinated campaign all look the same. The IP addresses don't settle it for www.afd.de, which records only a handful of distinct IPs on every day (probably a proxy). On sites that record real visitor IPs, bursts from 1–3 IPs (e.g. afd-lsa.de, afdbayern.de) are most likely automated. The number of form submissions is therefore not a number of people.
The biggest bursts
siteform iddatesubmissionsdistinct IPs that day
afd.de842022-11-0214,9274
afd.de332023-12-1113,4961
afd.de332023-12-105,2391
afd-lsa.de32023-05-031,8553
afdbayern.de62024-01-091,8333
afd.de842022-11-041,2002
afdkompakt.de22020-06-271,0772
afdkompakt.de22020-06-267002
afd.de1152023-11-056371
afd.de532018-11-236312
afd.de532018-11-225712
11 rows
Most database copies contain entries from September or October 2026. For 106 of 138 sites, the newest entry is from those months; the latest date is 5 October 2026. Each copy must have been made on or after its newest entry. The exact copying date cannot be read from this. The other sites have older newest entries. They may have been inactive for a while, or their data may come from older backups. For comparison, the newest email in the archive is from 14 September 2026.

B3 · How did the source process the data?

Besides copied databases, much of the archive is material the source made themselves: working queues, AI scores, tool output, and lists that re-sort the personal data into ready-to-use form. The flow below shows the archive by size: each folder, then what kind of material it holds. "Made by the source" is everything produced about the data rather than taken from a system.
Blue = original data taken from a system (290 GB, 98,917 files). Orange = made by the source, including some mixed working folders that also hold copied server files (11.0 GB, 2,050 files). Grey = public API snapshots and a public password list. By size, the source's material is small compared with the email; by file count it is large. It also includes the personal-data lists described below.
What the source built on top of the website databases (grouping by file name; counts inside the files are the source's):
  • Ready-made personal-data lists. 119 *.gf_named.tsv files match every form answer to its field label and class (email, first/last name, phone, city, member number, birth date).
  • Searching for personal data. Another 226 TSV files sweep every table of every site for anything that looks like personal data (362,398 rows, mostly irrelevant matches). 000072_inf6_identities.tsv lists 6.65 million identifiers (IPs, emails, phones). For www.afd.de, a separate bundle in 02_DATABASES/ holds extracted emails (86,237), phone numbers, names and addresses.
  • Triage. Keyword searches, category labels such as cat_illegal_activity, reading queues (MAIL_QUEUE_V2.tsv, 2.7 GB) and language-model scores. The briefing's "key findings" come from here: ~263,000 keyword-ranked records → 490 scored by a model → 136 rated high/critical → hand-checked sample.
  • Records of the access. Probe results, download lists, credential-reuse tests and a ledger of server access.
These lists contain nothing that isn't already in the original tables. With them, contact details can be collected in bulk without any database queries.

Notes

  • I analysed the data to the best of my knowledge and belief.
  • To the best of my knowledge, I removed data about private persons from the results shown here.
  • I used AI for the analysis. Only models running locally on my own machine saw the source data. Models from other providers were used to generate code.
  • The code to reproduce every step of this page is in the repository github.com/erikgoldenstein/afd-emails (instructions in src/metadata_analysis/REPRODUCE.md). The repository is currently offline and will be published once it is legally clear that this is permitted.
  • An analysis of the emails' contents already exists. It too will only be published once there is more legal clarity.
  • Contact: afd-emails@erik.gdn

Download the charts

All 21 charts as vector PDFs with selectable text, in German or in English.