Researchers Link Box.az Combolist to 4,705 Stolen Logins

In June 2026, HEROIC analysts identified a combolist file circulating on Telegram, labeled "box.az - 4.705 emails" and uploaded by a Telegram user. The file contained 4,705 records pairing email addresses with plaintext passwords and associated URLs, tied to Box.az accounts.

Why the Box.az Combolist Leak Is Dangerous

Every password in this file sits in plaintext, so anyone who downloads it can read the credentials instantly with no cracking required. Combined with the matching email addresses and URLs the logins were used on, an attacker has a direct path to test those same credentials against other websites where the password may have been reused.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

If your details are among the 4,705 exposed records, an attacker can attempt automated logins across other platforms in minutes, a tactic known as credential stuffing. Once one account falls, it often opens the door to others, especially if the same password protects email, banking, or shopping accounts, raising the risk of account takeover, identity theft, and financial fraud.

How This Combolist Was Likely Assembled

A combolist bundles email or username and password pairs, typically gathered from earlier breaches, phishing pages, or malware infections rather than one fresh hack. Files organized around a single service, like this Box.az list, let attackers focus their efforts on accounts tied to a specific platform before trading the results on Telegram channels.

Check If Your Box.az Login Was Exposed

If you want to know whether your email address appears in this combolist or any other leaked dataset, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. It takes seconds to check, and if you find a match, changing that password everywhere you have reused it is the fastest way to shut the door on attackers.