Our Analysts Found the i.ua Valid 100 Dump Circulating on Telegram

On January 18, 2023, HEROIC's dark web monitoring team found a combolist circulating on Telegram called "i.ua Valid 100." The file holds 12,689 records pairing email addresses with plaintext passwords and the URLs each login connects to.

Why the i.ua Valid 100 Leak Is Dangerous

The "Valid 100" label means the credentials in this file have already been tested and confirmed to work. That removes the guesswork for an attacker: every entry is a login that logs in, and since the passwords are stored as plaintext, they can be used instantly.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each login

Why This Matters for Your Accounts

Because these credentials are pre-verified, this file is more dangerous than an unchecked combolist of the same size. If your i.ua email and password are in here, and you have used that same password anywhere else, an attacker can move straight into your other accounts without any trial and error.

How This Combolist Was Built

A combolist pairs usernames or emails with passwords, one entry per line, usually compiled from older breaches, phishing pages, and malware-infected devices. What sets a "validated" list like this one apart is that criminals ran automated checks against the target service beforehand and kept only the logins that actually worked, then sold or shared the cleaned-up file on Telegram.

Check If You Are Affected

HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including this leak. Run a scan to see if your i.ua account or any other email was exposed, and get clear steps to secure it.