How Analysts Traced 17,433 Logins to app.artphototravel.com

HEROIC analysts traced 17,433 plaintext logins back directly to a users table on app.artphototravel.com, part of a combolist file dated December 2020. Each record pairs an email address with a readable password and a URL pointing directly to the site's own login page, matching the same format seen across most of the files reviewed in this batch.

Why tracing the source table matters

Knowing this data came directly from the site's own internal users table, rather than a scattered scrape, tells us these are active accounts people actually created and logged into, which makes password reuse from this file more likely to succeed elsewhere too.

What was exposed

• Email addresses, identifying every account in the users table
• Plaintext passwords, ready to use without any cracking
• URLs, pointing straight to the login page for each account

Why app.artphototravel.com users should care

If you created an account here in the past and reused the password anywhere else, this exposure isn't contained to one single site. It extends to every single account sharing that same password, and with over seventeen thousand records in this one table alone, that reach adds up quickly across a lot of different accounts.

How this table ended up in a combolist

Data pulled from a users table like this gets merged with credentials from other sources into one combolist file, built specifically so it can be run against login pages across the web, well beyond app.artphototravel.com itself.

Want to check if you're one of the 17,433?

Use a free scan your email to see whether your email is part of this exposure. If it is, change that password right away, update it anywhere it's been reused, and turn on two factor authentication where the option exists. This applies to work email addresses just as much as personal ones.