3 ms·

Here is another (Google) search query that yields a lot of email addresses and passwords: site:vk.com/doc "@gmail.com" As it turns out, vk.com (and other

Here is another (Google) search query that yields a lot of email addresses and passwords: site:vk.com/doc "@gmail.com" As it turns out, vk.com (and other large social networks) are used for discreetly sharing large lists of credentials. These are publicly crawled by Google but do not typically end up on lists of email or password breaches. You can find many credentials this way that are not (for example) in the haveibeenpwned database. More generally this is why "google dorking" can be a sophisticated reconnaissance method for collecting a variety of data that is technically public but not intentionally so.

weinzierl 8y ago
Just to put this in context and because in my experience many people miss this fact: vk.com is huge. SimilarWeb ranks it on position eight for worldwide traffic, this is right after Twitter and above Instagram and Wikipedia.
- jaytaylor 8y ago
  Never heard of this site. About: "VKontakte (or VK for short) is a social media networking site. Like most social media networks you can add friends, gain followers, and post photos of your food and your cat. VK, like Facebook also gives companies the ability to create their own pages for marketing purposes." https://www.echosec.net/what-is-vk-and-why-should-you-care/ https://www.echosec.net/what-is-vk-and-why-should-you-care/ Still don't understand why so many logins are being publicly exposed there.
  - guessmyname 8y ago
    > Still don't understand why so many logins are being publicly exposed there. • VK is the most popular website in Russia. • There are many hackers in Russia. Connect the points.
  - celticninja 8y ago
    VK is essentially russian Facebook, Russian hackees use it to store and share login lists from compromised servers muck like pastebin is used, however because most of the description alongside the list is in Russian it doesn't always get the sort of attention that an English language list would e.g end up in Krebsonsecurity it HIBP.com
52-6F-62 8y ago
Holy crap. There are a ton of what look like auto-generated or temporary emails in those lists. There are also a lot of what appear to be legitimate emails. That took all of two seconds. The first two links I clicked gave me lists of emails. The third one gave me a list of colon-delimited emails and passwords. https://vk.com/doc-75521656_324259084 That's a massive blunder.
- celticninja 8y ago
  I don't think it is a blunder, these are not emails being exposed accidentally by vk.com, these are credential lists created by hackers and shared or stored on vk

weinzierl 8y ago

Just to put this in context and because in my experience many people miss this fact: vk.com is huge. SimilarWeb ranks it on position eight for worldwide traffic, this is right after Twitter and above Instagram and Wikipedia.

jaytaylor 8y ago
Never heard of this site. About: "VKontakte (or VK for short) is a social media networking site. Like most social media networks you can add friends, gain followers, and post photos of your food and your cat. VK, like Facebook also gives companies the ability to create their own pages for marketing purposes." https://www.echosec.net/what-is-vk-and-why-should-you-care/ https://www.echosec.net/what-is-vk-and-why-should-you-care/ Still don't understand why so many logins are being publicly exposed there.
- guessmyname 8y ago
  > Still don't understand why so many logins are being publicly exposed there. • VK is the most popular website in Russia. • There are many hackers in Russia. Connect the points.
- celticninja 8y ago
  VK is essentially russian Facebook, Russian hackees use it to store and share login lists from compromised servers muck like pastebin is used, however because most of the description alongside the list is in Russian it doesn't always get the sort of attention that an English language list would e.g end up in Krebsonsecurity it HIBP.com

52-6F-62 8y ago

Holy crap. There are a ton of what look like auto-generated or temporary emails in those lists. There are also a lot of what appear to be legitimate emails. That took all of two seconds. The first two links I clicked gave me lists of emails. The third one gave me a list of colon-delimited emails and passwords. https://vk.com/doc-75521656_324259084 That's a massive blunder.

celticninja 8y ago
I don't think it is a blunder, these are not emails being exposed accidentally by vk.com, these are credential lists created by hackers and shared or stored on vk