Small List, Same Risk: Ionos_SMTPs 3-Record Password Leak

Ionos_SMTPs: 3 SMTP Login Records Exposed in a Telegram Combolist

On 21-Feb-2026, HEROIC analysts identified a small combolist uploaded to Telegram under the name "Ionos_SMTPs." The file contained just 3 records, but each one paired an email address with a plaintext password and the URL of the account it unlocks.

Why This Is Dangerous

A small record count does not mean small risk. Because the passwords are stored in plaintext and linked directly to the URLs they unlock, an attacker does not need to guess, crack, or search for a matching login. They can simply plug the credentials into the listed site and attempt to log in immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs identifying the login page for each account

Why This Matters

Even a handful of exposed logins can cause serious damage if the owner reused that same password anywhere else. Attackers routinely take small combolists like this one and run the credentials through automated tools that test the same email and password pair against banking sites, email providers, and social media platforms, a tactic known as credential stuffing. If a match is found, the result can be account takeover, identity theft, or direct financial fraud.

How Combolists Work

A combolist is simply a curated list of email-and-password combinations, sometimes pulled from a single small source and sometimes assembled from several. Even short lists like this Ionos_SMTPs upload circulate on Telegram and dark web forums, where buyers test the credentials before deciding whether to combine them with larger lists or sell them individually.

Check If You Are Affected

Whether a breach exposes 3 records or 3 million, the only way to know if you are one of them is to check. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to tell you instantly if your email address has been compromised.