The amrb27 Combolist: 127,206 Stolen Logins Hit the Dark Web

On August 1, 2026, HEROIC's dark web analysts identified a large combolist named “amrb27” uploaded to Telegram, exposing 127,206 records of email addresses and plaintext passwords, each tied to the URL it works on. It is one of the larger ready-to-use credential dumps analysts have catalogued recently.

Why the amrb27 Combolist Is Especially Dangerous

With more than 127,000 working login pairs in a single file, this combolist gives an attacker enormous scale to work with. Because every password is stored in plaintext and matched to a specific URL, automated tools can attempt logins across all 127,206 accounts in a fraction of the time it would take to target them one by one.

What Was Exposed in the amrb27 Leak

• Email addresses
• Plaintext passwords
• URLs identifying where each login works

Why This Matters

A leak of this scale is a goldmine for credential stuffing campaigns, which test stolen logins against dozens of other popular sites automatically. For the 127,206 people affected, the risk extends well past the original account, since any reused password could open the door to email, banking, or social media accounts elsewhere.

How a Combolist This Size Gets Built

Large combolists like amrb27 are typically compiled by merging multiple smaller breaches or stealer logs into one file, then cleaning and formatting the results into simple email and password pairs. The larger the file, the more attractive it becomes to buyers running large-scale automated attacks, which is why lists of this size circulate widely on Telegram.

Check If You Are Affected by the amrb27 Leak

Run your email through HEROIC's free breach scanner, which checks against more than 400 billion leaked records, to find out in seconds if you are one of the 127,206 people exposed in this leak. If you find a match, change that password immediately, especially anywhere else you may have reused it.