How the Random_Working_SMTPs Leak Could Fuel Spam Campaigns

HEROIC analysts identified a combolist titled Random_Working_SMTPs uploaded to a Telegram channel on June 18, 2026. The file contains 146 records pairing email addresses with plaintext passwords, along with URLs pointing to the mail server login associated with each account. Unlike a typical login combolist, this file is built specifically around SMTP credentials, the settings used to send email through a real mail server.

How the Random_Working_SMTPs Leak Could Fuel Spam Campaigns

An attacker who obtains working SMTP credentials can send email that appears to come from a genuine, established account rather than a throwaway address. That makes phishing emails, malware links, and spam far more likely to slip past spam filters and land in a recipient's inbox, since the email is technically sent from a real, previously trusted mail server.

What Was Exposed in This Combolist

• Email addresses
• Plaintext passwords
• URLs linked to each mail server login

Why This Matters for These 146 Accounts

If your email address is among these 146 accounts, someone else may be able to send messages that look like they came from you, which can damage your reputation and get your account flagged or blocked by email providers. If the same password was reused on other services, the risk expands further into account takeover, financial fraud, and identity theft.

How Working SMTP Combolists Like This One Work

Attackers test stolen or guessed email credentials specifically against SMTP servers to confirm the account can actually send outgoing mail, discarding any that fail. The word "working" in this file's name signals that every entry has passed that test, making the list valuable to spammers and phishing operators who need a steady supply of functioning mail accounts.

Check If You Are Affected by the Random_Working_SMTPs Leak

HEROIC maintains a database of more than 400 billion breached and leaked records, including SMTP-focused combolists like this one. Use HEROIC's free breach scanner to check whether your email address appears in this leak or any other exposure, and find out which passwords you should change first.