One Dark Web Listing: The 4Split1000 Combolist Had 998 Stolen Logins

In August 2026, HEROIC analysts spotted a small but active combolist called 4Split1000, uploaded by a Telegram user, exposing 998 records of email and username and password credentials, along with the URLs those logins connect to. While the count is modest compared to larger dumps, the data itself is just as usable by an attacker.

Why This Is Dangerous

A smaller list often gets less attention from defenders, but it is no less dangerous for the people in it. Each entry pairs a working email address with a plaintext password and the site it unlocks, giving an attacker everything needed to log in directly, no cracking or guessing required.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts tied to each login

Why This Matters

Even at under 1,000 records, this list can fuel credential stuffing against the exact accounts named in it. If any of these passwords are reused on other sites, an attacker can pivot from one compromised login into email, banking, or shopping accounts, opening the door to identity theft and financial fraud.

How Combolists Like 4Split1000 Are Built

A combolist is a curated file of email or username and password pairs, often collected from older breaches, stealer logs, or leaked databases and repackaged for resale or free distribution. Smaller lists like this one are frequently split off from larger collections, sometimes verified for accuracy before being shared, then circulated through Telegram channels where buyers test the credentials against real accounts.

Check If You Are Affected

This combolist is one of thousands feeding into HEROIC's database of more than 400 billion breached records. Use HEROIC's free dark web scanner to check whether your email address or passwords appear in this leak or any other exposure, and lock down your accounts before someone else does.