Did Your Login Leak in the 100 Combolist’s 36 Exposed Records?

HEROIC analysts logged 36 records inside a Telegram combolist labeled "100" on 01 Nov 2025. The file paired email addresses with plaintext passwords and the URLs where each login works, a small but complete set of ready to use credentials. Every entry in it is worth running past a proper email scan.

Why this is dangerous

Nothing in this file needs to be cracked or decoded. An attacker who downloads it can plug each email and password straight into a login page and see what opens. With only 36 entries, whoever built this list likely already tested the logins before posting them, which raises the odds that the working ones still work today.

What was exposed

• Email addresses: the username half of each login pair, useful for targeting phishing and confirming an account exists.
• Plaintext passwords: readable and usable immediately, no cracking required.
• URLs: the exact site each credential pair opens, saving an attacker the guesswork.

Why this matters

A list this size rarely stays put. Small combolists get folded into bigger compilations, resold, or tested against other services by anyone hoping the same password was reused elsewhere. If any of these 36 people typed that same password into more than one account, the exposure spreads well past whatever site it was first typed into.

How a combolist like this gets built

Combolists like this one are stitched together from older leaks, phishing catches, and malware harvests, then packaged and dropped into Telegram channels. The people running these channels sort and label the files, sometimes testing a sample of logins first, before offering the rest to buyers or followers for free.

Should you check if your login is in this file?

Scan your email against HEROIC's database to see if your address turns up in this combolist or any other. If it does, change that password immediately and update it anywhere else you used the same one. This check works the same whether you're looking up a personal inbox or a work email address, so it's worth running both.