Dark Web Intel: The ‘200kws’ Dump Actually Holds 111,409 Logins

HEROIC analysts tracked a combolist named 200kws circulating on a Telegram channel on 14-Feb-2026. The name implies roughly 200,000 records, but our verification shows the actual file contains 111,409 email addresses, plaintext passwords, and linked URLs, a real and still substantial number, just smaller than the filename suggests. Why This Is Dangerous: Every credential in this file is plaintext, meaning it can be used the moment someone downloads it, with no password cracking involved. At over 111,000 records, the file gives attackers a large pool of accounts to test in automated attacks. What Was Exposed: - Email addresses - Plaintext passwords - URLs linked to each login Why This Matters: Dark web dumps like this circulate quietly among criminal groups before wider awareness catches up, giving attackers a head start. If your email is among these 111,409 records and you reuse passwords across accounts, you face real risk of credential stuffing, account takeover, and identity theft, regardless of what the original filename claimed. How a Combolist Like This Works: Files like 200kws are typically compiled from multiple smaller leaks and malware logs, merged together and given an eye-catching name to attract downloads on Telegram and dark web forums. The advertised size in the filename is often rounded up or exaggerated, which is why HEROIC verifies the real record count rather than repeating the uploader's claim. Check If You Are Affected: Search your email with HEROIC's free breach scanner, which checks against more than 400 billion leaked records, to see if you were part of this dump or any other exposure circulating on the dark web.