advertise-noreplysupport.facebook.com Email Logins: 272 Leaked

HEROIC analysts reviewed a combolist titled advertise-noreplysupport.facebook.com 2, uploaded by a Telegram user and dated 24 January 2026. This is not evidence that Facebook itself was compromised. The file is a collection of 272 login pairs that happen to use the advertise-noreplysupport.facebook.com address pattern, gathered from other sources and bundled under that label. It still contains live email addresses and plaintext passwords, so it is worth taking a moment to scan your email.

Why a Notification Address Still Matters to Attackers

Addresses tied to automated notifications are often reused as login identifiers for other accounts, and the passwords attached to them are frequently reused as well. A pair pulled from this list can be tried against the matching inbox directly, then tested against banking, shopping, or social accounts that share the same password.

Exactly What This Small File Contains

• Email addresses
• Plaintext passwords
• URLs

The Risk for Anyone Whose Address Matches This Pattern

At 272 records this is a small file, but each entry is a readable, working credential pair. The realistic risks are unauthorized access to the matching inbox, password reuse attacks on other accounts, and phishing messages crafted to look like they come from the same notification source.

How a Combolist Like This Gets Put Together

Combolists are built by combining email and password pairs pulled from older leaks, stealer logs, and phishing campaigns, then sorting them by shared domain or address pattern. The advertise-noreplysupport.facebook.com label here simply describes the pattern the compiler used to group these particular entries, not a confirmed source of the breach.

Confirm Whether Your Address Made the List

Scan your email to check whether it appears in this file or similar lists. If it does, change the password right away and avoid reusing it anywhere else. This advice applies equally to a personal inbox and a work email address, since both can be the entry point attackers are looking for.