I know that criminals can readily find on the black market large dumps of password databases from hacked sites. These may contain the username, password, and email address for millions of users.
But what about IP addresses? Is it easy to find similar data sets that also contain, for each user, the last IP address that user used to log into the site? Or, to put it another way, is it easy for criminals to get their hands on a large database that lists, for many IP addresses, an email address for someone who might have recently used that IP address? By recent, I mean "in the past few years".
Suppose a criminal wants a large database that, for millions of users, has their email address and an IP address that user has recently used. (This would allow the criminal to do a lookup by IP address and retrieve an email address for a user who has used that IP address.) Is this readily available for sale on the criminal underground market? Or is this tough/expensive for criminals to come by?
Context: I'm trying to assess the plausibility of a hypothesis about how some people might be getting phished by a specific attack campaign. For these purposes, it would help to know whether it's easy for criminals to get their hands on large data sets that tell them not only usernames and passwords but also IP address information, or whether this information is not readily available to most garden-variety criminals. In other words, this is effectively a question about the economics of cybercrime: what is the cost to a criminal of obtaining a database of (emailaddr,ip_addr) records, compared to the cost of obtaining a database of (username,password,emailaddr) records?
I do know about NAT and dynamic IP address assignment and their implications for this situation.