What's in the leak

The hexane archive contains two independent datasets from different systems. They share only the occasional email address:

emails: ten mailboxes from the AfD's mail servers, and
websites: the WordPress databases of www.afd.de and ~140 other party websites.

This notebook answers the questions below one at a time. Every number is computed here from the files, unless it is explicitly marked as the source's: taken from the notes of the person or group who provided the data (the source below). Where two counts of "the same thing" disagree, the notebook explains which question each one answers. Read top to bottom. Each section starts with a short answer, then the evidence.

Part A: the emails

A1 · How many emails?

emails

421,178

stored messages, all folders

conversations

49,554

threads with 2+ emails

email addresses

93,635

in any header

time span

2013–2026

Mar 2013 to Sep 2026, by send date

Short answer: 421,178 emails. Each is a distinct message: the source deduplicated the archive by Message-ID before release (their DATA_DICTIONARY.md), and that holds. Only 42 emails share a Message-ID with another one, and 81 have none. So "copies of the same email in several mailboxes" is not a factor here: when two mailboxes held the same email, only one copy survived, in one of the folders. (That matters in A2.) The latest email is dated 14 September 2026: the emails end there. The website data (Part B) reaches about three weeks further.

The mailboxes cover very different windows: Gauland's runs 2017–2023, bundesgeschaeftsstelle@ stops in early 2018, and the hyphenated Holm folder covers just two weeks (A6). The 2016–2018 peak is mostly the bundesschiedsgericht@ folder, which holds far more than the arbitration court's mail (A2). An empty cell means the archive has no emails from that folder for that year.

A2 · Why DATA.md has two email tables with very different numbers

docs/DATA.md shows one table per mailbox (e.g. bundesschiedsgericht@ holds 101,078 emails) and one per address (that same address "received" only 8,800). Both are correct. They answer different questions:

table	question it answers
per mailbox	In which folder of the archive is an email stored?
per address	How often is an address written in an email's From/To/Cc/Bcc line, anywhere in the archive?

They would only match if every email in a folder were visibly from or to that folder's namesake. That isn't true. An email can reach a mailbox via Bcc, a mailing list, an alias or a forwarding rule, so the namesake is never written in the header. And a folder can hold other people's mail outright. The receiving mail server records the true recipient in a Delivered-To header, which shows what happened:

Three folders show the effect clearly:

Gauland: 32,615 emails stored. His address is in To/Cc only 13,167 times (DATA.md's "received" figure, 14,482, adds mentions in other folders). Yet the server recorded him as the real recipient on 32,600 (100%). Most of his mail reached him as Bcc, via lists or aliases. And he sent only 15 of them: this is an inbox, not a sent folder.
bundesschiedsgericht@ (federal arbitration court): 101,078 emails, but only 14,311 (14%) involve that address in any header. The folder is mostly other people's mail: the Sankey below shows Alice Weidel's, paypal@, Magnus Heutmann's and others. The folder name says where the source filed the mail, not whose mailbox it was.
leif.erik.holm@ (dotted): 60,215 emails, and the dotted address appears in none of them (0). It is the mail of leif-erik.holm@ (hyphen), the MV party office buero@afd-mv.de, the press office and others.

Rule of thumb: for "how much mail is in this folder" use the per-mailbox table. For "how much did person X write or receive" use the address, ideally with the delivery headers, and remember that a person can have several addresses (Jacobi has three).

Green links: delivered to the folder's own namesake. Violet: delivered to someone else. Grey: no delivery header (the server didn't record one) or smaller recipients folded into other. Hover a link for its count.

A3 · How many email threads?

A thread here is a set of emails linked through the Message-IDs they cite in their In-Reply-To/References headers (threads/ in the corpus; no subject matching). The headline number depends on what you call a thread:

300,807 threads if every unanswered email counts as its own thread.
49,554 conversations if a thread needs at least two emails. These hold 169,925 emails (40% of all).

84% of threads are a single email: newsletters, notifications, spam, one-off messages nobody answered, or replies whose predecessor isn't in the archive.

Two signs that the mailboxes are incomplete: 63,718 threads (21%) cite at least one earlier email that is not in the archive (98,919 missing emails in total, e.g. the sent copy of a reply). And only 9,111 threads span more than one mailbox folder, partly because of the Message-ID deduplication (A1).

A4 · Who sends the emails? Spam, politicians, AfD, companies, private persons

Each email gets one category from its sender address. The rules are simple and applied in order (first match wins). They live in src/analysis/senders.py:

#	category	rule
0	No sender address	the From header has no parsable address
1	Spam	server spam verdict, a spam-tagged subject, a throwaway top-level domain (.su, .mom, .makeup, …), or a rotating domain: ≥10 emails, ≥80% from a different address each time
2	AfD	a party domain (`afd…`, `alternativefuer…`, party shop/hosting)
3	Politics & state	parliaments (Bundestag, Landtage, EU), other parties, government, police, courts, city administrations
4	Automated & newsletters	auto-reply or mailing-list headers, no-reply/newsletter-style addresses, platforms (PayPal, Twitter, Amazon, …)
5	Private persons	a freemail provider (gmail, web.de, gmx, t-online, …): individuals writing from a personal account
6	Companies & orgs	everything else: a sender with its own non-party domain (businesses, associations, media, law firms)

These are statements about the address, not verified identities. An AfD MP writing from @bundestag.de counts under Politics & state, one writing from gmail under Private persons.

Short answer: about half of all email is AfD talking (53%): party offices, officials and party systems, from only 2,785 addresses. Private persons come next (18%), from by far the most addresses (17,247), followed by companies (15%; printers, merch suppliers, IT, lawyers, associations) and automated mail (10%; PayPal alone sends 22,000). Politics & state outside the AfD domains is small (2%; mostly @bundestag.de). Spam is 8,618 emails (2%), but from almost as many distinct addresses, the typical signature of spam.

Spam: the server's flag vs. these rules

Yes, there is a spam flag from the mail server (X-Spam-Flag, plus X-Spam-Score). But it can't answer "how much is spam" alone: most emails have no verdict at all, because they passed through servers that didn't add one. Where a verdict exists, it lets us check the rules above:

51,998 of 421,178 emails (12%) carry a server verdict: 1,227 YES, 50,771 NO. Coverage depends on the mail server: 100% for the hyphenated Holm folder, under 1% for bundesschiedsgericht@.
With the verdict hidden, the rules still catch 815 of the 1,227 server-YES emails (66%).
They also call 2,036 server-NO emails spam (4% of them). A random sample (below) shows these are spam the server missed, not false alarms.
On the 369,180 emails with no verdict, the rules find 5,324 spam.

So the count of 8,618 spam emails is a conservative estimate: the server flag alone gives a floor of 1,227, and the rules miss about a third of server-flagged spam, so the true figure is likely somewhat higher. Spam doesn't distort the overall picture either way: it is ~2% of the corpus.

Random sample: server said NO, rules say spam

subject (server said: not spam)	rule
Gelenkschmerzen loswerden	rotating sender addresses
Effektive Schmerzbehandlung	rotating sender addresses
Toxictm Off - Reinigt das Blut und Organe von Giften	throwaway top-level domain
Ist dein Messer unscharf? Mit Wolframcarbid-Messerschärfer kannst du i	rotating sender addresses
Die Verbesserung der Potenz und der Libido in jedem Alter	rotating sender addresses
Richtige Behandlung fur Bluthochdruck	rotating sender addresses
=?UTF-8?Q?St=C3=B6rt_dich, _dass_deine_Z=C3=A4hne_nicht_makellos_sind=	rotating sender addresses
Hochkonzentriertes Cannabisöl	rotating sender addresses
Gelenkschmerzen loswerden	rotating sender addresses
RE: Shipping services from China to worldwide	rotating sender addresses
Die Psoriasis kann endlich geheilt werden	throwaway top-level domain
Plus 1 Duschkopf als Geschenk: hautfreundliche Dusche zaubert seidig	rotating sender addresses

AfD and politics & state: who exactly?

Left (blue): the AfD. 221,769 emails come from party addresses, spread over 428 domains (the part of an address after the @) and 2,785 addresses. The chart shows the 10 domains that sent the most emails. Each bar is one domain. Its length and the number at its end give how many emails from addresses at that domain are in the ten mailboxes. Together these 10 domains account for 85% of all AfD emails. Right (orange): politics & state, meaning parliaments, other parties, government, courts and police (8,770 emails), split by kind of sender. Here too, the number at each bar is the number of emails.

Bundestag mail (7,068 emails from 155 addresses) is concentrated: 90% comes from 15 addresses, which belong to markus.frohnmaier, leif-erik.holm, beatrix.vonstorch, enrico.komning, alice.weidel, michael.espendiller, anton.friesen and their staff (.maNN). These are AfD MPs, so most of Politics & state is in fact AfD people writing from parliament accounts. Other parties barely appear as senders.

Each bar splits a category's sender addresses by how many emails each one sent. Private persons are mostly one-off writers: 13,199 of 17,247 private addresses (77%) wrote exactly once, members of the public writing to the party. AfD addresses are few but prolific. Spam is almost entirely 1 email: a new address every time.

A5 · What does it look like as a network?

Every address is a node. An edge goes from a sender to each address in To/Cc/Bcc, weighted by the number of emails.

addresses that sent or received

77,610

sender → recipient pairs

294,621

in one connected cluster

86%

66,512 addresses

pairs that wrote both ways

13%

Short answer: a few hubs and a huge fringe. 86% of addresses hang together in one cluster, held together by a handful of party addresses that mail hundreds or thousands of others. Most edges are one-directional: only 13% of sender→recipient pairs ever wrote back. The other 5,087 small clusters are mostly isolated pairs (4,415 of them): one outside address and one recipient that never connect to anyone else.

Read a row as this kind of sender, a column as writes to this kind of recipient. A delivery is one (email, recipient) pair, so one email to 100 recipients counts 100 times. That makes mass mailers loom large:

AfD → AfD is the biggest block: internal mail and party mailing lists.
Private persons → Politics looks big (10%), but it is inflated by people mailing whole parliaments: the 10 busiest private senders account for 34% of it, and 25% of all deliveries by private senders.
The same goes for Companies → Companies: the largest single sender in the archive, musik-baron.de, sent ~1,900 emails to ~100 recipients each (party addresses, MPs, media).

A two-way contact is the simplest sign of a real correspondence. Only a minority of private persons and companies ever got a reply in the archive. (Replies sent from addresses or mailboxes outside the archive are invisible here, so this is a lower bound.)

Two clusters dominate. On one side NRW (state office, arbitration court, Jacobi's three addresses, the state board), linked to the MV office (7, 16) and the fan shop (5, 6). On the other, the federal party around Gauland and Weidel (17, 11), surrounded by private and company mass mailers who write to them and to MPs of all parties (the large green dot, no. 1, is one such sender). Not shown: PayPal's notifications to paypal@alternativefuer.de, which form a separate island. Private persons are not named: they are listed by their mail provider only, and those writing from their own domain as own domain, without it (the sender rules count such domains as companies; here they are shown as private persons). The point is the structure, not identifying individuals.

A6 · Weird structures

Things in the email data that are not what they look like:

Two Holm mailboxes, and the bigger one never names its namesake. The dotted leif.erik.holm@afd-mv.de folder holds 60,215 emails from 2019 to 2026, but that spelling appears in no header of any email in the archive. The real address is the hyphenated leif-erik.holm@, whose own folder holds just 247 emails from 25 Dec 2022 to 9 Jan 2023, covering two weeks. The source's briefing lists only the hyphenated address.
Folders named after one address hold others' mail. bundesschiedsgericht@ is mostly Alice Weidel's, paypal@'s and Magnus Heutmann's mail (A2). A folder name says where the source filed the mail, not whose inbox it was.
unknown/ isn't unknown. Its 7,237 emails have no folder owner, but where a delivery header exists it names real accounts: bundesgeschaeftsstelle@alternativefuer.de (1,147), fabian.jacobi@afd.nrw (342), buero@afd-mv.de (245).
Inboxes vs. sent mail differ per folder. The namesake sent 0% of the emails in alexander.gauland@ but 68% in bundesgeschaeftsstelle@. Gauland's folder is an inbox (15 sent emails in six years). Questions like "how often did X reply" can only be answered where sent mail is in the archive.
sebastian.lux@ effectively stops in 2021. 31,817 of its 32,020 emails are from before 2022, then only 203 trickle in until 2026.
Delivery headers depend on the server, not the person. From 0% of emails (sebastian.lux@) to 100% (leif-erik.holm@). Where they're missing, Bcc and list recipients are invisible.
Mass mail. 31,750 emails have the exact same text as another email (newsletters, notifications, mailings sent one recipient at a time), though each has its own Message-ID.
Addresses that never send or receive. 14,774 of the 93,635 addresses appear only in a Reply-To header, typically web forms and newsletters ("reply to this person, not to me"). This is why DATA.md counts 93,635 addresses overall, but only 78,861 as senders or recipients.

A7 · How complete and how authentic are the emails?

Two checks on the quality of the data. First: how many emails have no readable text? Second: are the emails still exactly as they were sent? For many emails this can be checked through their DKIM signature (explained further down). The DKIM results come from uv run verify-dkim (see REPRODUCE.md).

4,283 emails (1.0%) have no readable text. Most of them are not broken: 3,513 consist only of attachments (a PDF, a scan, a calendar invitation), 281 are automatic read receipts, and in 230 Outlook packed the text into a winmail.dat attachment. 132 have an HTML part without any text (typically a newsletter made of images), 67 are encrypted, and only 60 are completely empty. No folder stands out: the share lies between 0.2% and 2.0% (schiedsgericht@). These emails still count in every number that is based on headers.

What is DKIM? A digital signature that the sender's mail server attaches to an email when sending it; if the text or one of the signed headers (such as sender, subject or date) is changed afterwards, the signature no longer matches.

100,929 emails (24%) carry a DKIM signature. The share varies by year, from 11% (2018) to 44% (2026). (56 emails could not be parsed by the verifier; they count as unsigned.) What the signatures say today:

27,120 verify completely: text, headers and the sender's key, which is still published.
7,628 are mathematically intact, but expired or made with the outdated SHA-1.
20,993 have an unchanged text, but the sender's domain no longer publishes the key, so the header part can't be checked. That is normal for old mail: keys get replaced.
11,204 have an unchanged text, but the header check fails. Either a header line was changed on the way (mail gateways tag subjects, for example), or the domain has since published a new key under the same name.
33,805 have a text that no longer matches what the sender signed. This check needs no key, so it is reliable for old mail too.

A broken seal does not prove a forgery. An intact one says only that the text is what the sending server signed, not that it is true.

Edited emails? The changed texts are a technical pattern, not individual edits. 31,690 of the 33,805 emails with a changed text (94%) are in one folder, bundesschiedsgericht@. There, 92% of all signed emails from Feb 2015 to 17 September 2019 are affected, from every kind of sender (PayPal receipts, Gmail, Twitter …). Then it stops from one day to the next: of the 1,397 signed emails after that date, 1 is affected. The folder's volume drops sharply at the same time. In all other folders, 3.3% of the signed emails have a changed text, with no comparable cluster. Hand edits would hit a few chosen emails, not almost every PayPal receipt of a month. The pattern fits software that re-encoded the stored emails, for example when the mailbox was moved to another system. A separate check of 200 changed and 200 intact emails from this folder (not run in this notebook) supports that: 171 of the changed ones contain base64 blocks wrapped uniformly at 76 characters, against 85 of the intact ones. In the same check, appended or prepended text, line endings and mbox >From quoting explained none of the changes.

Part B: the website data

B0 · Where does it come from, and did the websites lead to the mail?

Two accounts can be checked against each other here: the archive itself, and the reconstruction by Lilith Wittmann and Hoodinformatik ("Zweimal gehackt", 20 October 2026), which rests on statements from the hackers and from people close to the hosting provider. What the article says happened: an insecure WordPress site, wahlkampf.afd.de, was the way in. A plugin (WP-Console) gave a command line on the server, from there the way led into the mail administration; the passwords of party officials' mailboxes were changed and the mail downloaded over IMAP. A first run was noticed on 9 September (about 180 GB), a second one on 14 September was stopped around 6 a.m. after about 300 GB in all. The systems belong to Alternita Dienstleistungs GmbH, the party's own service company, which runs hosting for many state and local associations. What the archive shows for itself: 04_TABULAR_DATA/000428_raw_console.jsonl is a log of 201 shell commands from 12 September, run with the rights of the wahlkampf.afd.de website, inside that site's folder. The commands and their output contain working passwords and API keys, so the notebook only shows when each command ran and what kind of step it was (read off the command, see analysis/access.py).

Read from the outputs of the same log:

Passwords from the web server. The configuration files of every site on the machine are read, including database passwords.
The mail-management system answers. The internal app behind mail-management.afd.de is read from disk; with a key found there, its API first refuses (HTTP 401), then returns data (HTTP 200). Around 16:30 a list of all mail users (≈0.9 MB) is downloaded and turned into a mailbox table. The archive's mailbox-management table (000678_mm_mailboxes.tsv) is the same kind of record.
Mail-server logins work for a system account (no-reply@…) on three mail hosts.
The direct route fails. For two hours there are attempts to mount the mail storage (NFS_…_MAIL_BACKEND) from the web server; every attempt is refused.
Not visible in this log: the WP-Console plugin (it is also not among the site's active plugins in its exported settings), and the changing of mailbox passwords. Both may have happened outside this one session, which covers only 201 commands on one afternoon.

A second record cross-checks the article's hour. The archive also holds the mailbox table of the mail-management system (000678_mm_mailboxes.tsv, 2,219 mailboxes; the password column is not read here). It shows 6 new mailboxes on 14 September between 04:24 and 04:27 UTC (06:24–06:27 German time), each noted as "Backup-Account von …@afd.nrw". One of them is the backup of fabian.jacobi@afd.nrw, whose mailbox is in the archive. The table doesn't say who created them, or why. The timing fits the article's "detected around 6 a.m.". The table's newest change is from 08:47 UTC that morning, so this copy was made after the detection. Password changes, checked: 9 of the leaked mailbox folders appear in this table (the dotted leif.erik.holm@ doesn't: it is no mailbox of its own, which fits A2). Only 1 of them changed in September 2026 (schiedsgericht@afd.nrw at 05:24 UTC on 14 Sep), after the detection. The table keeps only the latest change per mailbox, so earlier changes could be overwritten, but for the untouched ones there is no sign of a password change through this system. If passwords were changed, it happened somewhere this table doesn't record.

How article and archive fit together:

Claim in the article	What the archive says
The way in was the WordPress site wahlkampf.afd.de	Supported. The shell log runs as that site's user, in its folder.
WP-Console gave the command line	Not shown. Neither the shell log nor the site's exported settings name it.
From there into the mail administration	Supported. The log reads the mail-management app and pulls the full user list through its API.
Mailbox passwords were changed, mail downloaded over IMAP	IMAP plausible, password changes not seen. IMAP logins work in the log; the mail-management table shows no September change on the mailboxes in the archive before the detection (see above).
First run noticed on 9 Sept	Not confirmed. No email in the corpus mentions an incident. The only notice is planned "further server work" on the party's member system for 14–15 Sept, announced on 10 Sept; that may or may not be related.
Access kept after the first run	Consistent. The shell session was on 12 Sept, and the newest emails in the mailboxes are from 11 to 14 Sept.
Second run detected around 6 a.m. on 14 Sept	Supported. 6 "Backup-Account" mailboxes appear between 06:24 and 06:27 German time. The newest emails are from 08:29 and 09:04 German time, so mail still arrived, or was still copied, after that.
≈300 GB in total	Matches the publication. The archive is 302 GB, of which 225 GB is email; the rest is website databases, documents and images. The split into 180 GB and 120 GB can't be checked: the source's upload records only cover the three oldest mailboxes.
The same mailboxes were copied twice	Consistent. Only 42 emails share a Message-ID, so the second copies were removed before publishing.
AfD: mainly older mailboxes	Partly. Three folders end before September 2026 (Gauland 2023, Bundesgeschäftsstelle 2018, the hyphenated Holm address 2023), but the large ones reach into September 2026.
Access to ≈300 mailboxes, largest first	Consistent. The archive holds 10 named mailbox folders, a small, large-volume selection out of the 2,219 the mail-management system lists.
Alternita runs 300+ domains	Not comparable. That counts domains (the mail system alone lists 500); B1 counts the WordPress databases that were exported.

Beyond the mail, the source's work files record further website access: database logins with credentials from site configuration files (wp-config) and backups, and a self-made single-sign-on token that, by their own record, gave admin access on afd-fraktion-hessen.de (000264_SERVER_ACCESS_LEDGER.tsv). wahlkampf.afd.de and alternita.de are both among the exported sites; Alternita also appears as the operator of an order system (bestellung.alternita.de) and as admin accounts named alternita_* on party sites.

B1 · How many websites leaked, and which domains?

Short answer: 139 websites: www.afd.de plus 138 other party-related sites. How that number comes about, because it differs from the "140" in DATA.md:

04_TABULAR_DATA/ holds table exports under 142 different export names.
One of them (h4_route_samples) isn't a website (output of one of the source's tools).
One (afd_de) is a later copy of www.afd.de, whose main database is in 02_DATABASES/.
That leaves 140 export names (DATA.md's "140 other websites"). Each site's own siteurl setting shows that two pairs are the same site: afd-dessau-rosslau_de, afd_dessau_rosslau_de, ruben-rupp_de, test-micro_afd_de (afd-dessau-rosslau.de, ruben-rupp.de). test-micro.afd.de is a staging copy of ruben-rupp.de. So there are 138 distinct domains, plus www.afd.de.

Every domain below is read from the site's own database (siteurl setting), not guessed from the file name. The site types are this notebook's own grouping, read off the domain.

All 139 leaked websites (one row per distinct domain, grouped by site type; counts are distinct records in the leaked database, as in B2). Scroll the list; links open the live site.

#	domain	site title (its own setting)	accounts	form entries	posts & pages	comments	newest entry
National party, campaigns & media
1	afd.de	Alternative für Deutschland	7	138,049	5,214	0	2026-10-04
2	afdkompakt.de	AfD Kompakt	18	5,080	12,166	0	2026-09-29
3	bilddatenbank.afd.de	bilddatenbank.afd.de	2	0	2	0	2026-09-29
4	gemeinsam-fuer-das-grundgesetz.de	Gemeinsam für das Grundgesetz	6	0	20	0	2025-07-07
5	generationdeutschland.de	Generation Deutschland	8	53	9	0	2026-08-28
6	mitmachen.afd.de	Mitmachen in der AfD	4	0	16	0	2026-09-29
7	sachsen-anhalt.afd.de	AfD Sachsen-Anhalt	0	0	9	0	2025-05-13
8	spenden.afd.de	AfD Spenden	4	0	9	0	2026-09-29
9	wahlkampf.afd.de	Wahlkampfportal der AfD	6	0	39	0	2025-12-10
State association
10	afd-brandenburg.de	AfD Brandenburg	7	0	248	7	2026-09-03
11	afd-frauen.nrw	Frauen in der AfD	4	0	12	3	2026-09-29
12	afd-lsa.de	AfD Sachsen-Anhalt	9	8,573	288	0	2025-10-17
13	afd-mv.de	Alternative für Deutschland Mecklenburg-Vorpommern	11	1,548	4,367	3	2026-10-05
14	afd-thueringen.de	AfD Thüringen	39	3,512	4,819	79	2026-10-03
15	afd.berlin	AfD Landesverband Berlin	10	546	60	0	2026-10-02
16	afd.nrw	AfD NRW	9	1,106	2,118	8	2026-10-03
17	afd.saarland	AfD Saarland	5	1,237	811	4	2026-10-03
18	afdbayern.de	AfD Bayern	16	9,485	1,625	4	2026-10-04
19	alternative-rlp.de	AfD Rheinland-Pfalz	8	969	751	4	2026-01-02
20	in.afdbayern.de	Bayern intern	477	556	360	0	2026-09-09
21	plakatshop.afdbayern.de	AfD Bayern Plakatshop	66	0	18	109	2026-09-29
22	russlanddeutsche-afd.nrw	Russlanddeutsche für die AfD NRW	6	416	1,194	3	2026-08-24
Regional association
23	afd-bezirk-arnsberg.de	AfD Bezirk Arnsberg	8	352	75	53	2026-09-15
24	afd-bezirk-duesseldorf.de	AfD Bezirk Düsseldorf	9	215	95	0	2024-08-09
25	afd-bezirk-muenster.de	AfD Bezirk Münster	9	195	63	15	2026-09-24
26	afd-bezirk-owl.de	AfD Bezirk Ostwestfalen-Lippe	9	223	457	18	2026-09-29
27	afd-oberbayern.de	AFD Oberbayern \| Bezirksverband Oberbayern \| Alternative für	7	89	102	19	2026-09-30
Local chapter
28	afd-anhalt-bitterfeld.de	AfD Kreisverband Anhalt-Bitterfeld	10	439	173	24	2026-10-01
29	afd-aw.de	AfD Ahrweiler	10	161	564	0	2026-09-30
30	afd-bad-kissingen.de	AfD Bad Kissingen	5	74	20	0	2026-10-02
31	afd-bgl.de	AfD Berchtesgadener Land	7	0	126	6	2026-09-04
32	afd-bielefeld.de	AfD Kreis Bielefeld	17	133	3,237	4	2026-10-03
33	afd-bottrop.de	AfD Kreis Bottrop	10	370	194	45	2026-10-04
34	afd-dessau-rosslau.de	AfD Kreis Dessau-Roßlau Stadt	8	296	619	15	2026-01-07
35	afd-dortmund.de	AfD Kreis Dortmund	8	787	543	50	2026-10-02
36	afd-duisburg.de	AfD Kreisverband Duisburg	6	708	95	27	2026-09-29
37	afd-ennepe-ruhr.de	AfD - Kreisverband Ennepe-Ruhr	5	412	15	0	2026-09-30
38	afd-essen.de	AfD Kreis Essen	4	707	297	52	2026-09-08
39	afd-euskirchen.de	AfD Kreis Euskirchen	7	483	47	3	2026-06-10
40	afd-hagen.de	AfD Kreisverband Hagen	7	272	230	46	2026-09-23
41	afd-harzkreis.de	AfD Kreisverband Harz	8	135	24	1	2026-09-10
42	afd-hassberge.de	AfD Haßberge / Rhön-Grabfeld	7	71	20	0	2026-09-30
43	afd-herford.de	AfD Kreis Herford	8	204	500	28	2026-10-05
44	afd-hochsauerlandkreis.de	AfD Hochsauerlandkreis	7	121	58	9	2026-10-04
45	afd-hro.de	AfD Hansestadt Rostock	9	111	23	0	2026-09-18
46	afd-iserlohn.de	AfD Fraktion im Stadtrat Iserlohn	5	262	46	3	2025-12-01
47	afd-kelheim.de	AfD Kreisverband Kelheim	4	4	55	0	2026-10-04
48	afd-krefeld.de	AfD Kreis Krefeld	10	423	143	9	2026-10-05
49	afd-kreis-borken.de	AfD Kreis Borken	7	350	189	13	2026-09-29
50	afd-kreis-coesfeld.de	AfD Kreis Coesfeld	9	258	199	9	2026-09-29
51	afd-kreis-duesseldorf.de	AfD Kreis Düsseldorf	8	625	248	32	2025-10-10
52	afd-kreis-hamm.de	AfD Kreis Hamm	7	484	160	7	2026-10-04
53	afd-kreis-olpe.de	AfD Kreis Olpe	9	44	153	5	2026-09-30
54	afd-kreis-recklinghausen.de	AfD Kreis Recklinghausen	9	686	1,392	104	2026-09-30
55	afd-kreis-wesel.de	AfD Kreisverband Wesel	5	551	283	61	2026-05-21
56	afd-kreisverband-rottal-inn.de	AfD Kreisverband Rottal-Inn	0	0	47	0	2026-10-03
57	afd-landsberg-lech.de	Afd Landsberg Lech	8	85	23	7	2026-09-30
58	afd-lichtenfels.de	AFD Kreisverband Lichtenfels	9	75	55	0	2026-09-30
59	afd-main-spessart.de	AfD Kreisverband Main-Spessart	6	89	15	0	2026-09-30
60	afd-mettmann.de	AfD Kreis Mettmann	13	581	1,319	18	2025-08-18
61	afd-minden-luebbecke.de	AfD Kreisverband Minden-Lübbecke	5	519	426	45	2026-10-03
62	afd-moenchengladbach.de	AfD Kreis Mönchengladbach	12	666	39	0	2025-12-03
63	afd-mse.de	AfD Kreisverband Mecklenburgische Seenplatte	6	575	185	14	2026-10-01
64	afd-muelheim.de	AfD Kreis Mülheim	10	672	343	32	2026-10-04
65	afd-muenchen-land.de	Kreisverband München Land	6	78	15	51	2026-10-02
66	afd-muenchen-ost.de	AfD Kreis München Ost	7	108	122	4	2026-02-20
67	afd-muenchen.de	AfD München	18	143	917	0	2026-10-01
68	afd-muenster.de	AfD Kreisverband Münster	8	794	1,109	52	2026-09-29
69	afd-neuburg-schrobenhausen.de	AfD Kreis ND-SOB	1,932	293	16	0	2026-09-30
70	afd-nwm.de	AfD Kreisverband Nordwestmecklenburg	9	273	1	0	2026-09-29
71	afd-oberberg.de	AfD Kreisverband Oberberg	1,816	498	863	288	2026-10-04
72	afd-oberhausen.de	AfD Oberhausen	7	311	1,148	2	2026-10-04
73	afd-passau.de	AfD Kreisverband Passau	7	74	55	3	2026-10-03
74	afd-rhein-kreis-neuss.de	AfD Rhein Kreis Neuss	14	373	369	0	2025-09-25
75	afd-ro.de	AfD Kreisverband Landkreis Rostock	7	557	284	12	2026-09-29
76	afd-schwarzwald-baar.de	AfD Kreisverband Schwarzwald-Baar	8	218	20	0	2026-10-03
77	afd-schweinfurt-land.de	AfD Kreisverband Schweinfurt-Land	5	4	5	0	2026-09-30
78	afd-siegen-wittgenstein.de	AfD Kreis Siegen-Wittgenstein	7	489	403	17	2026-03-03
79	afd-sn.de	AfD Kreisverband Schwerin	4	326	17	13	2026-06-25
80	afd-swm.de	AfD Kreis Südwestmecklenburg	7	181	36	16	2026-07-05
81	afd-trier.de	AfD Kreisverband Trier	6	261	50	10	2026-09-30
82	afd-unterallgaeu-memmingen.de	AfD Kreis Unterallgäu-Memmingen	9	255	426	37	2026-09-30
83	afd-vg.de	AfD Kreisverband Vorpommern-Greifswald	7	239	1,999	0	2026-10-02
84	afd-vr.de	AfD Kreisverband Vorpommern-Rügen	7	383	190	26	2025-10-25
85	afd-weiden.de	AfD Weiden \| Kreisverband	5	26	696	0	2026-10-02
86	afd-weilheim-schongau.de	AfD Kreisverband	7	8	116	30	2026-09-09
87	afd-wuerzburg.de	AfD Kreis Würzburg	4	284	53	14	2026-09-30
88	afd-wuppertal.de	AfD Kreis Wuppertal	5	0	29	12	2026-09-29
89	afd.koeln	AfD Köln	13	1,402	651	16	2026-10-05
90	afdosnabrueck.de	AfD Kreisverband Osnabrück	6	368	193	30	2026-10-04
91	afdsaarpfalz.de	AfD Saarpfalz	5	39	18	0	2026-09-30
92	alternative-fuer-mk.de	AfD Märkischer Kreis	9	816	184	16	2026-10-03
93	kebst-blue.volker-heinecke.de	Katrin Ebner-Steiner	13	366	199	58	2026-09-29
Berlin district
94	friedrichshain-kreuzberg.afd.berlin	AfD Bezirk Friedrichshain-Kreuzberg	17	18	24	0	2026-08-31
95	lichtenberg.afd.berlin	AfD-Bezirksverband Lichtenberg	9	18	153	0	2026-10-02
96	marzahn-hellersdorf.afd.berlin	AfD Bezirksverband Marzahn-Hellersdorf	10	18	208	70	2026-09-14
97	mitte.afd.berlin	AfD Bezirksverband Berlin Mitte	9	18	12	0	2026-08-31
98	neukoelln.afd.berlin	AfD Bezirksverband Neukölln	6	18	49	0	2026-08-25
99	pankow.afd.berlin	AfD Berlin-Pankow	10	1,782	80	86	2026-10-02
100	reinickendorf.afd.berlin	AfD Bezirksverband Reinickendorf	11	18	145	110	2026-08-31
101	spandau.afd.berlin	AfD Bezirk Spandau	8	18	16	48	2026-09-06
102	steglitz-zehlendorf.afd.berlin	AfD Steglitz-Zehlendorf	12	18	13	0	2026-09-18
103	tempelhof-schoeneberg.afd.berlin	AfD Bezirksverband Tempelhof-Schöneberg	11	18	33	0	2026-09-10
104	treptow-koepenick.afd.berlin	AfD Treptow-Köpenick	8	18	87	18	2026-09-30
Parliamentary group
105	afd-do-fraktion.de	Aktuelles	6	27	887	12	2026-09-30
106	afd-fraktion-duisburg.de	AfD-Fraktion im Rat der Stadt Duisburg	9	82	360	12	2026-10-04
107	afd-fraktion-en.de	Alternative für Deutschland, Kreistagsfraktion Ennepe-Ruhr	6	29	97	17	2026-09-30
108	afd-fraktion-hessen.de	AfD-Fraktion Hessen	9	939	1,354	14	2025-09-08
109	afd-fraktion-luenen.de	AfD Fraktion im Stadtrat Lünen	9	75	115	118	2026-09-30
110	afd-fraktion-rkn.de	AfD-Fraktion Rhein-Kreis Neuss	6	39	26	2	2025-09-25
111	afd-fraktion-siegen.de	AfD-Ratsfraktion Siegen	4	158	52	3	2026-09-30
112	afd-fraktion-tk.de	AfD Fraktion Treptow-Köpenick	8	375	607	45	2026-09-30
113	afd-fraktion-vg.de	AfD-Fraktion Vorpommern-Greifswald	9	22	85	0	2026-09-30
114	afd-fraktion-witten.de	Alternative für Deutschland Ratsfraktion Witten	5	147	118	22	2026-10-02
115	afd-fraktion-wuppertal.de	AfD-Fraktion im Rat der Stadt Wuppertal	8	32	48	9	2026-09-30
116	afd-fraktion.koeln	AfD-Fraktion im Rat der Stadt Köln	7	370	814	27	2026-10-01
117	afd-fraktion.saarland	AfD Fraktion Saarlandes	5	105	48	7	2026-10-03
118	afd-im-roemer.de	AfD-Fraktion im Römer	7	224	918	20	2026-09-30
119	afd-kreistag-abi.de	AfD im Kreistag Anhalt-Bitterfeld	7	114	49	8	2026-09-30
120	afd-kreistag-rostock.de	AfD Fraktion - Bündnis Deutschland	7	53	165	29	2026-09-30
121	afd-kreistag-siwi.de	AfD im Kreistag Siegen-Wittgenstein	6	22	67	10	2026-09-30
122	afd-kreistagsfraktion-hsk.de	afd-kreistagsfraktion-hsk	0	0	29	0	2026-10-03
123	afd-ratsfraktion-bottrop.de	AfD-Ratsfraktion Bottrop	9	7	219	10	2026-09-30
124	afd-stadtrat-muenchen.de	Offizielle Seite der AfD im Münchner Stadtrat.	8	0	459	2	2026-09-30
125	afd-stadtrat-trier.de	Die Demokraten im Stadtrat Trier	8	24	145	13	2026-03-16
Politician's own site
126	afd-gottschalk.de	Kay Gottschalk \| Mitglied des Deutschen Bundestages	7	175	891	40	2026-09-30
127	alice-weidel.de	Alice Weidel - AfD Kanzlerkandidatin 2025	2	0	658	0	2026-06-29
128	bernd-schattner.de	Bernd Schattner	10	0	99	60	2026-09-22
129	daniel-roi.de	Daniel Roi	8	209	133	35	2026-10-01
130	horst-foerster.de	Horst Förster, MdL	6	45	136	14	2026-09-28
131	kay-uwe-ziegler.de	Kay-Uwe Ziegler, Mitglied des Deutschen Bundestages	4	264	283	21	2026-09-30
132	richard-graupner.de	Richard Graupner, MdL	7	30	812	17	2026-10-01
133	ruben-rupp.de	Ruben Rupp - Ihr Landtagsabgeordneter im Wahlkreis Schwäbisc	26	206	656	0	2024-12-01
134	thomas-roeckemann.de	Abgeordneter Thomas Röckemann	7	780	382	2	2026-10-04
135	wolfgang-wiehle.de	Wolfgang Wiehle	11	19	241	0	2026-10-03
Not a party site
136	alternita.de	Alternita	5	0	21	65	2026-09-30
137	bestellung.alternita.de	bestellung.alternita.de	5	0	4	0	2025-06-24
138	die-demokraten-trier.de	Die Demokraten im Stadtrat Trier	8	29	191	23	2026-09-30
139	ngofakten.de	NGO Fakten	5	0	38	0	2026-06-03

B2 · What is in the website data?

A WordPress site keeps everything in database tables. The ones that matter, counted as distinct records (many sites were exported twice; counting rows would double-count):

what	records (138 sites)	on how many sites	www.afd.de (later copy)
site accounts (admins, editors: name, email, password hash)	5,375	137	7
form submissions (contact, membership, donation, volunteer forms: names, emails, phones, addresses)	62,318 + 3,031 Elementor	119	138,049
reader comments (name, email, IP)	2,697	95	0
published articles & pages	64,352	140	5,214
all `posts` entries (incl. drafts, revisions, uploads, plugin records)	319,148	140	47,972
copies of emails the site sent (`postman_sent_mail`)	20,297	110	250
admin activity log (who did what, with IP)	2,007,088	124	0

The personal data is in the forms. 200,367 form submissions, two thirds of them on www.afd.de, hold what visitors typed in: names, email addresses, phone numbers, postal addresses, sometimes dates of birth. (Not every submission is a distinct person; see the bursts below.) Because these are party sites, a submission also hints at political sympathy (a special category under GDPR Art. 9). About the numbers: they come from src/analysis/wordpress.py and count distinct (site, table prefix, id). DATA.md's figures for the same tables are mostly 2–13% lower (e.g. 282,734 posts entries, 59,446 form submissions; comments are the exception, 2,708). No script for them exists in the repository, so the difference can't be traced. The sent-mail count matches exactly (20,047 on 109 sites) when the nine small 4–11-file site captures are left out, so DATA.md likely excluded some of those.

State associations (Bavaria, Saxony-Anhalt, Thuringia) and the party newspaper AfD Kompakt hold the most submissions; in.afdbayern.de (by its name, the Bavarian party's internal site) has by far the most accounts (477). The admin log column shows that many sites recorded every admin login and edit, with IP address. Sent-mail logs stop at exactly 250 on most sites: the logging plugin keeps only the latest ones.

The curve is flat (a few hundred to a few thousand a month) except for bursts: single days on which one form received 500+ submissions. There are 11 such days, holding 42,166 submissions (21% of all since 2017). The two big ones are on www.afd.de, where a normal day brings 20–150 submissions. What they are can't be told from these tables: a bot flood, a mass import or a coordinated campaign all look the same. The IP addresses don't settle it for www.afd.de, which records only a handful of distinct IPs on every day (probably a proxy). On sites that record real visitor IPs, bursts from 1–3 IPs (e.g. afd-lsa.de, afdbayern.de) are most likely automated. Either way, form submissions are not the same as people.

The biggest bursts

site	form id	date	submissions	distinct IPs that day
afd.de	84	2022-11-02	14,927	4
afd.de	33	2023-12-11	13,496	1
afd.de	33	2023-12-10	5,239	1
afd-lsa.de	3	2023-05-03	1,855	3
afdbayern.de	6	2024-01-09	1,833	3
afd.de	84	2022-11-04	1,200	2
afdkompakt.de	2	2020-06-27	1,077	2
afdkompakt.de	2	2020-06-26	700	2
afd.de	115	2023-11-05	637	1
afd.de	53	2018-11-23	631	2
afd.de	53	2018-11-22	571	2

Most databases were copied in September/October 2026. The newest entry in each database shows this: a copy can't contain entries made after it was taken. For 106 of 138 sites the newest entry is from September or October 2026, so these databases were copied in those weeks, the last one on 5 October 2026. The other sites have an older newest entry. That doesn't necessarily mean they were copied earlier: either nothing happened on the site for a while, or the copy came from an older backup. For comparison, the newest email in the archive is from 14 September 2026.

B3 · How did the source process the data?

The source didn't just copy databases. Much of the archive is their own work: working queues, AI scores, tool output, and lists that re-sort the personal data into ready-to-use form. The flow below shows the archive by size: each folder, then what kind of material it holds. "Made by the source" is everything produced about the data rather than taken from a system.

Blue = original data taken from a system (290 GB, 98,917 files). Orange = made by the source, including some mixed working folders that also hold copied server files (11.0 GB, 2,050 files). Grey = public API snapshots and a public password list. By size the source's material is small next to the email, but by file count it isn't, and it includes the lists that matter most for privacy.

What the source built on top of the website databases (grouping by file name; counts inside the files are the source's, from DATA.md):

Ready-made personal-data lists. 119 *.gf_named.tsv files match every form answer to its field label and class (email, first/last name, phone, city, member number, birth date). 226 more TSVs sweep every table of every site for anything that looks like personal data (362,398 rows, mostly noise). 000072_inf6_identities.tsv lists 6.65 million identifiers (IPs, emails, phones). For www.afd.de, a separate bundle in 02_DATABASES/ holds extracted emails (86,237), phone numbers, names and addresses.
Triage. Keyword searches, category labels such as cat_illegal_activity, reading queues (MAIL_QUEUE_V2.tsv, 2.7 GB) and language-model scores. The briefing's "key findings" come from here: ~263,000 keyword-ranked records → 490 scored by a model → 136 rated high/critical → hand-checked sample.
Records of the access. Probe results, download lists, credential-reuse tests and a ledger of server access.

None of this adds information that isn't in the original tables; it removes the effort. With these lists, collecting contact details at scale needs no database work at all.

Notes

I analysed the data to the best of my knowledge and belief.
Also to the best of my knowledge and belief, I removed data about private persons from the results shown here.
I used AI for the analysis. Only models running locally on my own machine saw the source data. Models from other providers were used to generate code.
The code to reproduce every step of this page is in the repository github.com/erikgoldenstein/afd-emails (instructions in REPRODUCE.md). The repository is currently offline and will be published once it is legally clear that this is permitted.
An analysis of the emails' contents already exists. It too will only be published once there is more legal clarity.
Contact: afd-emails@erik.gdn

Download the charts

All 21 charts as vector PDFs with selectable text, in German or in English.

Charts in German (PDF, zip)Charts in English (PDF, zip)