How a Telegram Post Led to 101,402 Leaked Italy-Linked Credentials

HEROIC analysts traced a combolist called 105k Italy by ryder699, uploaded by a Telegram user on 2 April 2024, containing 101,402 records. The distributor's handle, "ryder699," tagged the file as Italy-linked, and it follows the standard combolist format: email addresses paired with plaintext passwords and the URLs of the login pages they belong to.

Why This Is Dangerous

How a Telegram post led to 101,402 leaked credentials starts the same way most combolists do: a distributor compiles login pairs from earlier sources, labels the batch by size and target region to make it easier to sell, and posts it to a channel where anyone can grab a copy. Once a file like this is public, it spreads far beyond the original poster within hours.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the login pages tied to each account

Why This Matters

With more than 100,000 records in one file, attackers have a large pool of working email and password pairs to test against banking, shopping, and social media logins. Anyone in this batch who reused a password on another account faces exposure well beyond the original login, which is exactly what fuels large-scale credential stuffing campaigns.

How Combolists Work

A combolist is built by pulling email and password pairs from stealer logs, older breaches, or phishing operations, then organizing and labeling them, often by region or size, before distribution. Sellers like the one behind this file typically post samples or full batches to Telegram channels to build a reputation, after which the credentials are picked up and tested by others using automated login tools.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including large combolists like this one. Run a free search now and change any password that comes back exposed.