1,104 Logins Found in the 21-JAN Dark Web Combolist File

HEROIC analysts found a dark web combolist named 21-JAN that was uploaded to Telegram on 21 January 2026. The file holds 1,104 records, each pairing an email address with a plaintext password and the URL the credential was used on. With the passwords stored in readable text, anyone who downloads this file can start testing the logins right away. It only takes a minute to scan your email and see if you are on this list.

What a Small Combolist Can Still Do

Even a modest file like this one is dangerous because every entry pairs a working email, password and target site together. Attackers can run automated login attempts against the exact service each record was captured for, and because the file is small, it can be processed and acted on quickly rather than sitting unused.

The Login Data Found in This January Combolist

• Email Addresses
• Plaintext Password
• URLs

What This Means if Your Email Is Listed

If you appear in 21-JAN, the most immediate concern is someone signing into the exact account the URL identifies. Should that password be reused anywhere else, the risk spreads further, potentially reaching your email, banking or work accounts depending on where the same credentials were used.

How a File Like 21-JAN Comes Together

Smaller combolists like this are typically pulled from a mix of older leaks, phishing campaigns or malware infected devices, then cleaned up so every line is a usable email and password pair. Once compiled, files like this circulate on Telegram channels dedicated to sharing and trading stolen credentials.

Check Your Email Before Someone Else Uses It

Scan your email to see if it appears in 21-JAN or any other dataset HEROIC has indexed. If you find a match, change that password immediately, particularly anywhere you have reused it, and turn on two-factor authentication where it is available. This applies to work email as much as personal accounts.