10,293 Logins for FacepunchForums-fp2016 Hit a Combolist

HEROIC analysts found a dark web combolist containing 10,293 login records tied to FacepunchForums-fp2016 accounts, uploaded to Telegram on 23 August 2026. Each line pairs an email address with a plaintext password and the forum URL the login was used on. This file is a collection of credentials for FacepunchForums accounts rather than evidence that the forum's own systems were breached, but the risk to anyone whose login appears here is just as real. A quick scan of your email will tell you whether you need to take action.

What a Combolist of Forum Logins Enables

Attackers load combolists like this into automated tools that attempt to sign in using every listed email and password, both on the original forum and on any other site where the same password might have been reused. Because the passwords are stored in plain text, there is no technical barrier between downloading the file and using the credentials.

The Account Data Found in This Forum Combolist

• Email Addresses
• Plaintext Password
• URLs

The Risk for Anyone in This List

If your email shows up here, someone could log into your FacepunchForums-fp2016 account directly, read private messages, or post under your name. The bigger danger comes if that password was reused on email, gaming or shopping accounts, since attackers routinely test the same login everywhere it might work.

Where Combolists Like This Originate

Credential lists tied to a specific forum are often pieced together from older leaks, phishing campaigns or malware infections on users' own devices rather than a break in at the forum itself. Once assembled, they are cleaned, deduplicated and shared on Telegram so other criminals can put the logins to use.

Check Whether Your Login Is in This File

Scan your email to see if it appears in FacepunchForums-fp2016 or any other dataset HEROIC tracks. If it does, change that password right away, especially anywhere you reused it, and enable two-factor authentication where available. This applies equally to personal and work email, since one reused password can connect both.