Dark Web Intel: 249k Shopping Sites Combo Exposes 349,643 Logins

Dark Web Monitoring Flags a Major Shopping Combo List

HEROIC's dark web monitoring identified a stealer log dataset called "249k Shopping Sites hQ Combolist" circulating in a Telegram channel on January 8, 2023. Despite the "249k" in its name, the actual file HEROIC analyzed contains 349,643 records, each combining an email address, a plaintext password, and the URL of the shopping site the login belongs to.

Why This Is Dangerous

This combo list is built around online shopping accounts, which usually have saved payment methods, stored addresses, and order history attached. Because the passwords are in plaintext, an attacker can log straight into an account without needing to crack anything first. With 349,643 records to work through, automated tools can attempt logins at scale, checking which accounts are still active and which ones still use the exposed password.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the shopping sites tied to each login

Why This Matters

A takeover of a shopping account can lead directly to financial fraud: saved cards can be used for unauthorized purchases, loyalty points and gift balances can be drained, and stored personal details can be harvested for identity theft. Because many people reuse the same email and password across multiple retailers, a single exposed credential from this list can unlock several shopping accounts at once.

How Stealer Logs Work

Large combo lists like this one are typically stitched together from many individual stealer log infections. Info-stealing malware harvests saved browser credentials from infected devices, and criminals then sort and merge that raw data by category, in this case filtering for shopping and e-commerce site logins, before packaging it for distribution on Telegram and dark web marketplaces. The result is a targeted list that is more valuable to buyers than an unsorted dump.

Check If You Are Affected

If you shop online regularly, it is worth checking whether your email address appears in this or any other leak. HEROIC's free breach scanner checks against more than 400 billion breached records pulled from dark web sources, stealer logs, and known breaches, giving you a fast way to see if your shopping accounts are at risk.