How a Telegram Upload Exposed 34,191 SplashyArt.FlyingCart.com Logins

How a Telegram Upload Exposed SplashyArt.FlyingCart.com Users

On August 20, 2023, HEROIC analysts tracked a combolist tied to splashyart.flyingcart.com being uploaded to a Telegram channel. The file contains 34,191 records, each combining an email address, a plaintext password, and the associated account URL. No encryption protects the passwords, so the data is usable the moment someone downloads the file.

Why This Is Dangerous

Once a password is stored or shared in plain text, there is no barrier left between the data and an attacker. There is nothing to crack, nothing to guess. Whoever has this file can attempt to log into the account within seconds of downloading it, using the exact credentials the account owner set.

What Was Exposed

• Email Addresses: the account identifiers, useful for phishing and for locating other accounts owned by the same person.
• Plaintext Passwords: readable, functioning passwords requiring no decryption.
• URLs: the exact login pages tied to each set of credentials.

Why This Matters

Combolists like this one feed directly into credential stuffing, where attackers use automated tools to try each email and password pair against dozens of major websites. If you reused this password for email, banking, or shopping accounts, this single leak could open the door to identity theft or financial fraud far beyond the original account.

How This Combolist Was Likely Compiled

Combolists are typically assembled from data pulled out of earlier breaches, malware-infected devices, or previous leak dumps, then merged and organized around a specific domain, in this case splashyart.flyingcart.com. The person who uploaded it to Telegram was likely a distributor rather than the original attacker, repackaging already-stolen credentials so other criminals can use them for account takeover attempts.

Check If You Are Affected

If you have ever used splashyart.flyingcart.com or reused a password elsewhere, check your exposure now. HEROIC's free dark web scanner searches more than 400 billion breached records, this one included, and shows you instantly whether your email address turned up in the leak.