Our Analysts Found the ftc-i.net Combolist With 8,065 Stolen Logins

In June 2026, HEROIC analysts discovered a combolist labeled ftc-i.net - 8.065 emails circulating in a private Telegram channel. The file contained 8,065 records, each pairing an email address with a plaintext password and the URL the login belongs to. Why our analysts flagged this ftc-i.net combolist: this file stood out because it was already sorted and labeled by domain, ftc-i.net, before it was even shared, a sign that whoever compiled it deliberately targeted users of that specific service. Sorted lists like this are more valuable to attackers because they can focus credential stuffing attempts directly against the platform the data came from. What was exposed in the ftc-i.net leak: email addresses, plaintext passwords, and URLs tied to each account. Why this matters for the 8,065 people involved: because the credentials in this file are already organized and verified against a specific domain, they're primed for immediate use. Anyone whose email appears here faces a real risk of account takeover on that platform, and further risk of identity theft or financial fraud if the same password was reused anywhere else. How domain-sorted combolists get made: attackers often filter large, unsorted credential dumps down by email domain or website, isolating the accounts tied to one target so the resulting list is smaller but far more useful. This kind of curation, visible in the ftc-i.net file name, takes more effort than dumping raw data, which usually means the credentials inside have already been checked and are more likely to still work. Check if you are affected: if you have an account tied to ftc-i.net or a similar service, check your email against HEROIC's free breach scanner, which searches more than 400 billion leaked records for an instant result.