224 DirectAdmin Server Logins Leaked in Vulnerable Panel Dump

Vuln_DirectAdmin Combolist Leaks 224 Server Control Panel Logins

HEROIC analysts identified a combolist titled "Vuln_DirectAdmin," uploaded by a Telegram user on 4 July 2026. The file contains 224 records, each pairing an email address with a plaintext password and the URL of the DirectAdmin control panel the credentials belong to.

Why This Is Dangerous

DirectAdmin is server management software used to control hosting accounts, websites, and email on a server, so these credentials aren't limited to a single account, they can open the door to everything hosted on that server. The "Vuln" label suggests these panels were found with weak or exploitable security, and since the passwords are stored in plaintext, anyone with the file can log in right away.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (DirectAdmin control panel addresses)

Why This Matters

An attacker who gains access to a DirectAdmin panel can view or take over every website, database, and email account managed through it, turning one compromised login into a much larger incident. For the 224 accounts in this file, the risk extends to any customer, business, or user whose data lives on those servers, and reused passwords could expose even more accounts through credential stuffing.

How This Vulnerability-Based Combolist Was Built

Rather than coming from a single hacked company, this type of file is typically built by scanning the internet for DirectAdmin panels with weak configurations, then testing common or previously leaked passwords against them. The 224 logins that succeeded were compiled into this file and shared on Telegram, where other attackers can use them to access the same servers.

Check If You Are Affected

If you manage a DirectAdmin server or any hosting control panel, or reuse passwords across your admin accounts, it's worth checking your exposure. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to help you find out quickly and secure any account that may be at risk.