Inside the advertise-noreplysupport.facebook.com 5 File: 754 Logins

In January 2026, HEROIC analysts found a combolist called advertise-noreplysupport.facebook.com 5 containing 754 email and password pairs stored in plain text, each one linked to a specific login URL. Scanning your email is the fastest way to find out if you are one of the 754.

754 Passwords With Nothing Standing in the Way

None of the passwords in this file needed to be cracked, decrypted, or guessed. They were stored in plain text, so whoever has the file can read every password the moment they open it. That turns 754 separate accounts into 754 logins that are ready to use immediately.

Everything Bundled With Each of the 754 Logins

• Email Addresses: tells an attacker exactly who the login belongs to, which is useful for sending convincing phishing messages.
• Plaintext Password: readable without any extra work, so it can be tried on this account or any other where the same password was used.
• URLs: shows precisely which site each password opens, removing any need to search for the right login page.

How One Leaked Password Turns Into Several Problems

Once an attacker logs in using one of these 754 pairs, the damage rarely stops at that single account. A hijacked email can be used to reset passwords on other services, and if the leaked password was reused anywhere else, those accounts become exposed too. Multiply that by 754 records, and the potential fallout spreads well beyond the original file.

The Pattern Behind a File Like This One

Files like this are typically assembled by pulling together email and password combinations that already existed from earlier logins, usually because a password was reused across more than one account. The person compiling the list matched each email to its password and the site it worked on, then combined all 754 into a single combolist. It takes no special hacking skill, only a collection of passwords that were never unique to begin with.

754 Reasons to Check Your Inbox Today

Scan your email to see whether your address is one of the 754 in this file. If it is, change the password immediately, both on this account and anywhere else you may have reused it. The same advice holds for a personal inbox and a work email account alike.