Inside the U.S.: The ‘1.1 Million URL Login Pass’ Combolist Leak

In May 2026, HEROIC analysts reviewed a combolist uploaded to Telegram under the name "1.1 Million URL Login Pass." Despite the name, the version analysts confirmed actually contains 351,367 verified records of email addresses, plaintext passwords, and the URLs each login was used on. Why this is dangerous: even at the confirmed count of 351,367 records, this is still a large-scale combolist. Because every password is stored in plaintext and paired with a specific website URL, an attacker doesn't need to guess where a stolen login might work, the file tells them exactly which site to try it on first. What was exposed in the "1.1 Million URL Login Pass" combolist: email addresses, plaintext passwords, and URLs identifying the exact site or service each login belongs to. Why this matters: a file this size gives attackers enough volume to run automated credential stuffing campaigns across hundreds of thousands of accounts at once. Anyone who reused a password from one of these 351,367 records on another site is at risk of account takeover, and because URLs are included, criminals can quickly sort the list by target, whether that's email providers, retailers, or financial services. How a combolist like this one comes together: combolists like this one are usually compiled from a mix of older breaches, phishing kits, and malware-infected devices, then merged, deduplicated, and labeled with an eye-catching name before being shared or sold on Telegram. The gap between the advertised "1.1 million" and the actual 351,367 verified records is common in this underground market, sellers often inflate numbers to attract buyers. Check if you are affected: with over 351,000 records in circulation, it's worth checking whether your email address is part of this leak. HEROIC's free breach scanner searches more than 400 billion leaked records to show you your exposure and help you secure any accounts that may be at risk.