go.id Domain Combolist Zoomed In: 75,720 Logins Exposed

Zoom in on this file and there is not much to see beyond a domain suffix and a number. HEROIC analysts catalogued a combolist labeled go.id on Telegram, dated 30 Jun 2026, holding 75,720 email and plaintext password pairs. The label gives no company or agency name, just the shared suffix tying every account in the file together.

Why a Bare Domain Suffix Still Signals Danger

A file organized around a shared domain ending tells an attacker that every credential inside it likely belongs to a related set of organizations, even without knowing which one specifically. That is enough structure to run targeted phishing campaigns against the whole group at once.

What This File Contains

• Email addresses identify each account tied to the go.id suffix and become phishing targets.
• Plaintext passwords are ready to use with no cracking required.
• URLs show which specific login page each credential pair was captured from.

Why the Missing Detail Does Not Lower the Risk

Not knowing exactly which organization a leaked account belongs to does not slow an attacker down much; automated tools test every pair against common login pages regardless of the exact site name. The credentials work the same whether or not the file bothers to spell out where they came from.

How a Suffix-Sorted Combolist Like This Is Built

An uploader collects credentials from breaches, phishing kits, and other lists, then filters them down to accounts sharing a common domain pattern, here the go.id suffix, before packaging and sharing the result. This sorting method does not identify a single organization as the source of the leak.

Does This 75,720-Record File Include Your Login?

Scan your email to check whether your address turns up in this file or any other HEROIC has on record. If it does, change that password everywhere you have reused it and switch on two factor authentication wherever it is offered. Run this check for your work email as well as personal accounts, since a shared domain suffix often points to workplace logins.