‘Good 100 Valid’ Combolist Leaks 3,357 Logins, a Small Town’s Worth

On 16 February 2026, a combolist titled "Good 100 Valid" was uploaded to Telegram. Despite the "100" in its name, HEROIC verified the file actually contains 3,357 records of email addresses, plaintext passwords, and associated URLs, roughly the population of a small town, all exposed at once.

Why This Is Dangerous

The "Valid" tag means the uploader claims to have already confirmed these credentials work. Combined with plaintext passwords, that makes this list immediately usable by anyone who downloads it, no cracking, no guesswork, just copy and paste into a login form.

What Was Exposed

The "Good 100 Valid" combolist contains:

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

A verified-valid list of this size is exactly what credential stuffing tools are built to exploit, testing each of the 3,357 email and password pairs against banking, email, and shopping sites in bulk. Anyone in this file who reused their password anywhere else faces a real risk of account takeover and identity theft.

How This Combolist Was Built

Combolists labeled "valid" go through an extra step before distribution: the seller runs a checker tool against each entry to confirm the login still works, then keeps only the working credentials. This weeding-out process is why "valid" combolists, even modest ones like this, are considered more dangerous and more valuable than raw, unverified dumps.

Check If You Are Affected

With 3,357 confirmed-valid credentials in this single file, it's worth checking your own exposure. HEROIC's free breach scanner searches more than 400 billion leaked records, including this combolist, to tell you if your email has been compromised.