HEROIC Researchers Link Jobinmoscow.ru to 148,383 Stolen Logins

HEROIC researchers traced a combolist tied to the domain jobinmoscow.ru after it was uploaded to a Telegram channel. The underlying breach dates to August 18, 2023, and the file contains 148,383 records, each pairing an email address with a plaintext password and the URL of the site the login belongs to.

Why the Jobinmoscow.ru Leak Is Dangerous

Because the passwords in this file are plaintext, an attacker does not need to crack or decrypt anything to use them. Each record already includes the URL of the site it unlocks, so the file functions as a direct, ready-made list of working logins rather than raw data that needs sorting first.

What Was Exposed in the Jobinmoscow.ru Breach

• Email addresses
• Plaintext passwords
• URLs identifying the associated website for each login

Why This Matters for the 148,383 Accounts Involved

A breach tied to a job-related site can be especially valuable to attackers, since job platforms often collect personal details that support broader identity theft, not just a single password. If any of the 148,383 accounts reused their password elsewhere, that reuse gives attackers a direct path into email, banking, or other accounts through credential stuffing.

How This Combolist Continued to Circulate

Combolists tied to a specific domain, like this one linked to jobinmoscow.ru, are often built from a single breach event and then repackaged and shared repeatedly on Telegram and dark web forums over time. A breach from 2023 resurfacing years later shows how long stolen credentials can keep circulating and being reused by new groups of attackers.

Check If You Are Affected by This Breach

If your email address is among the 148,383 records tied to jobinmoscow.ru, your password may still be circulating on the dark web. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this one, so you can confirm your exposure and secure any accounts using the same password.