btamail.net.cn Combolist: 20,443 Emails and Passwords Leaked

HEROIC analysts identified a combolist uploaded by a Telegram user on 10 June 2026, tied to btamail.net.cn and containing 20,443 records. Each entry pairs an email address with a plaintext password and the URL of the login page it belongs to, giving anyone who obtains the file a large, ready-to-use set of working credentials.

Why This Is Dangerous

Because these passwords are stored and leaked in plaintext, no cracking or decryption is required to use them. An attacker can read each password directly and pair it instantly with the matching login URL. At more than 20,000 records, this list gives whoever holds it a large, ready-made target base rather than a puzzle to work through.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

A list of this size is exactly what attackers look for to run large-scale credential stuffing campaigns. Automated tools can test each of the 20,443 email and password combinations against banking sites, email providers, and shopping platforms in a matter of minutes. Anyone who reused one of these passwords elsewhere faces a real risk of account takeover, financial fraud, or identity theft.

How Combolists Work

A combolist is a large text file of email and password pairs, typically gathered from earlier breaches, phishing campaigns, or stealer malware and merged into a single master list. Criminals build combolists specifically to power credential stuffing attacks, automatically testing thousands of login attempts against websites to find which ones still work. This btamail.net.cn list follows the same pattern seen across countless Telegram channels, where combolists are traded and redistributed before spreading further across the dark web.

Check If You Are Affected

With over 20,000 credential pairs circulating, the odds that your information is affected are real if you have any connection to this list. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can quickly find out whether your credentials appear in this combolist or any other and change your passwords before an attacker gets there first.