Credential Risk: dpf 1.edu.lk – 567 emails uploaded by a Telegram User

In June 2026, HEROIC analysts identified a combolist titled "dpf 1.edu.lk - 567 emails uploaded by a Telegram User" shared on a Telegram channel. The file contained 567 records pairing email addresses with plaintext passwords, along with URLs identifying where each credential pair originated. The listing's name points to accounts tied to the edu.lk domain, and because the passwords are stored in plaintext, they can be used immediately by anyone who downloads the file.

Why This edu.lk Combolist Leak Is Dangerous

Because the file is built around a specific email domain, an attacker doesn't need to search widely to find a target, they already have 567 working email and password pairs tied to that domain in one place. Since the passwords are plaintext, no cracking is required before someone starts testing them against email logins, school portals, or any other account that might share the same password.

What Was Exposed in the dpf 1.edu.lk Combolist

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to its source site

Why This Matters Beyond the edu.lk Domain

Even though this file is centered on one email domain, the risk extends to every other account tied to that email address. Because none of these 567 passwords were hashed, they're immediately usable in credential stuffing attacks, where the same email and password combination is tried across many other websites. Reusing a password anywhere else means that account is exposed too, which can lead to account takeover, financial fraud, or identity theft.

How Combolists Like This One Are Built

A combolist is a compiled file of email or username and password pairs, usually gathered from earlier breaches, leaks, or stealer logs and packaged into a single list, sometimes organized around a specific domain as this one is. Lists like this circulate on Telegram channels and dark web forums, where they are shared or sold cheaply, making them accessible to attackers with little technical skill.

Check If You Are Affected

You don't have to guess whether your email is one of the 567 records in this combolist. HEROIC's free breach scanner checks your email against a database of more than 400 billion exposed records, including combolists, stealer logs, and other leaked data. Run a free scan now, and change any reused passwords if your information turns up.