investigating the leaked afd emails - eriks site

What's in the leakThe hexane archive contains two independent datasets from different systems.

They share only the occasional email address:emails: ten mailboxes from the AfD's mail servers, andwebsites: the WordPress databases of www.afd.de and ~140 other party websites.This notebook answers the questions below one at a time. Every number is computed here from the files, unless it is explicitly marked as the source's: taken from the notes of the person or group who provided the data (the source below). Where two counts of "the same thing" disagree, the notebook explains which question each one answers.

Read top to bottom.

Each section starts with a short answer, then the evidence.Part A: the emailsA1 · How many emails?emails421,178stored messages, all foldersconversations49,554threads with 2+ emailsemail addresses93,635in any headertime span2013–2026Mar 2013 to Sep 2026, by send dateShort answer: 421,178 emails. Each is a distinct message: the source deduplicated the archive by Message-ID before release (their DATA_DICTIONARY.md), and that holds. Only 42 emails share a Message-ID with another one, and 81 have none. So "copies of the same email in several mailboxes" is not a factor here: when two mailboxes held the same email, only one copy survived, in one of the folders.

(That matters in A2.)

The latest email is dated 14 September 2026: the emails end there. The website data (Part B) reaches about three weeks further.The mailboxes cover very different windows: Gauland's runs 2017–2023, bundesgeschaeftsstelle@ stops in early 2018, and the hyphenated Holm folder covers just two weeks (A6). The 2016–2018 peak is mostly the bundesschiedsgericht@ folder, which holds far more than the arbitration court's mail (A2). An empty cell means the archive has no emails from that folder for that year.A2 · Why DATA.md has two email tables with very different numbersdocs/DATA.md shows one table per mailbox (e.g. bundesschiedsgericht@ holds 101,078 emails) and one per address (that same address "received" only 8,800).

Both are correct.

They answer different questions:tablequestion it answersper mailboxIn which folder of the archive is an email stored?per addressHow often is an address written in an email's From/To/Cc/Bcc line, anywhere in the archive?They would only match if every email in a folder were visibly from or to that folder's namesake. That isn't true. An email can reach a mailbox via Bcc, a mailing list, an alias or a forwarding rule, so the namesake is never written in the header. And a folder can hold other people's mail outright. The receiving mail server records the true recipient in a Delivered-To header, which shows what happened:Three folders show the effect clearly:Gauland: 32,615 emails stored. His address is in To/Cc only 13,167 times (DATA.md's "received" figure, 14,482, adds mentions in other folders). Yet the server recorded him as the real recipient on 32,600 (100%). Most of his mail reached him as Bcc, via lists or aliases. And he sent only 15 of them: this is an inbox, not a sent folder.bundesschiedsgericht@ (federal arbitration court): 101,078 emails, but only 14,311 (14%) involve that address in any header. The folder is mostly other people's mail: the Sankey below shows Alice Weidel's, paypal@, Magnus Heutmann's and others. The folder name says where the source filed the mail, not whose mailbox it was.leif.erik.holm@ (dotted): 60,215 emails, and the dotted address appears in none of them (0). It is the mail of leif-erik.holm@ (hyphen), the MV party office buero@afd-mv.de, the press office and others.Rule of thumb: for "how much mail is in this folder" use the per-mailbox table. For "how much did person X write or receive" use the address, ideally with the delivery headers, and remember that a person can have several addresses (Jacobi has three).Green links: delivered to the folder's own namesake.

Violet: delivered to someone else.

Grey: no delivery header (the server didn't record one) or smaller recipients folded into other.

Hover a link for its count.A3 · How many email threads?A thread here is a set of emails linked through the Message-IDs they cite in their In-Reply-To/References headers (threads/ in the corpus; no subject matching).

The headline number depends on what you call a thread:300,807 threads if every unanswered email counts as its own thread.49,554 conversations if a thread needs at least two emails. These hold 169,925 emails (40% of all).84% of threads are a single email: newsletters, notifications, spam, one-off messages nobody answered, or replies whose predecessor isn't in the archive.Two signs that the mailboxes are incomplete: 63,718 threads (21%) cite at least one earlier email that is not in the archive (98,919 missing emails in total, e.g.

the sent copy of a reply). And only 9,111 threads span more than one mailbox folder, partly because of the Message-ID deduplication (A1).A4 · Who sends the emails?

Spam, politicians, AfD, companies, private personsEach email gets one category from its sender address.

The rules are simple and applied in order (first match wins). They live in src/analysis/senders.py:#categoryrule0No sender addressthe From header has no parsable address1Spamserver spam verdict, a spam-tagged subject, a throwaway top-level domain (.su, .mom, .makeup, …), or a rotating domain: ≥10 emails, ≥80% from a different address each time2AfDa party domain (afd…, alternativefuer…, party shop/hosting)3Politics & stateparliaments (Bundestag, Landtage, EU), other parties, government, police, courts, city administrations4Automated & newslettersauto-reply or mailing-list headers, no-reply/newsletter-style addresses, platforms (PayPal, Twitter, Amazon, …)5Private personsa freemail provider (gmail, web.de, gmx, t-online, …): individuals writing from a personal account6Companies & orgseverything else: a sender with its own non-party domain (businesses, associations, media, law firms)These are statements about the address, not verified identities. An AfD MP writing from @bundestag.de counts under Politics & state, one writing from gmail under Private persons.Short answer: about half of all email is AfD talking (53%): party offices, officials and party systems, from only 2,785 addresses. Private persons come next (18%), from by far the most addresses (17,247), followed by companies (15%; printers, merch suppliers, IT, lawyers, associations) and automated mail (10%; PayPal alone sends 22,000). Politics & state outside the AfD domains is small (2%; mostly @bundestag.de). Spam is 8,618 emails (2%), but from almost as many distinct addresses, the typical signature of spam.Spam: the server's flag vs. these rulesYes, there is a spam flag from the mail server (X-Spam-Flag, plus X-Spam-Score). But it can't answer "how much is spam" alone: most emails have no verdict at all, because they passed through servers that didn't add one.

Where a verdict exists, it lets us check the rules above:51,998 of 421,178 emails (12%) carry a server verdict: 1,227 YES, 50,771 NO.

Coverage depends on the mail server: 100% for the hyphenated Holm folder, under 1% for bundesschiedsgericht@.With the verdict hidden, the rules still catch 815 of the 1,227 server-YES emails (66%).They also call 2,036 server-NO emails spam (4% of them). A random sample (below) shows these are spam the server missed, not false alarms.On the 369,180 emails with no verdict, the rules find 5,324 spam.So the count of 8,618 spam emails is a conservative estimate: the server flag alone gives a floor of 1,227, and the rules miss about a third of server-flagged spam, so the true figure is likely somewhat higher.

Other parties barely appear as senders.Each bar splits a category's sender addresses by how many emails each one sent.

Private persons are mostly one-off writers: 13,199 of 17,247 private addresses (77%) wrote exactly once, members of the public writing to the party.