The brtph7ee.bnr.ca Combolist Means Someone Could Be in Your Inbox

HEROIC analysts identified a combolist labeled brtph7ee.bnr.ca - 6.152 emails, uploaded by a Telegram user on 10 June 2026. The file contains 6,152 email addresses tied to the bnr.ca subdomain, paired with plaintext passwords and the URLs of the login pages each credential belongs to.

Why This Is Dangerous

The brtph7ee.bnr.ca combolist means someone could be sitting on 6,152 working email and password combinations right now, ready to try each one against real login pages. Because the passwords sit in plaintext next to the exact site they unlock, there is no extra work required before an attacker can attempt access.

What Was Exposed

• Email addresses tied to the bnr.ca domain
• Plaintext passwords
• URLs of the login pages tied to each account

Why This Matters

A working email login is often the key to resetting passwords on other services, so anyone in this batch of 6,152 records risks more than just their inbox being accessed. If a password here was reused on banking, shopping, or social accounts, the exposure spreads well past the original login, a common setup for credential stuffing.

How Combolists Work

A combolist is assembled by collecting email and password pairs, often pulled from stealer logs or older breaches, then filtered down to accounts tied to a specific domain, as with this bnr.ca-focused batch. Criminals load domain-specific lists like this into automated tools that test every pair against the real login page in bulk, keeping the ones that still work and discarding the rest.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including domain-specific combolists like this one. Run a free search to see if your address is among the 6,152 exposed.