You Could Be One of 862,379 Exposed Logins in lines_.us

A combolist called lines_.us surfaced on Telegram on January 6, 2026, pairing 862,379 email addresses with plaintext passwords and the URLs those logins were used on. Each pairing in the file represents a password that has already been confirmed to work somewhere. Scanning your email is the only way to know if your own pairing is among them.

Why Each Pairing in This File Is Already Proven to Work

A random list of guessed passwords is one kind of risk. A combolist is a different and more immediate one, since every pairing inside it was kept specifically because it matched a login that had already been seen working. That verification step is what separates this file from a simple list of leaked passwords.

What Was Exposed

• Email Addresses: shows the exact account each password in the file is tied to.
• Plaintext Password: left completely readable, with no cracking required before use.
• URLs: records the login where that email-password pairing was last seen working.

Why This Matters

Because every pairing here already worked once, the odds of it still working are higher than for an average leaked password. If you reused that same password on other accounts, those too become easy targets for anyone holding this file.

How This Breach Type Works

lines_.us wasn't lifted from a single breached company. It came together by comparing credentials already exposed in separate incidents and keeping the ones where the same password appeared more than once, bundled afterward under one label.

Is Your Email One of the 862,379 in lines_.us?

Check the scan your email tool above to see for yourself. If your pairing shows up, change that password everywhere you've used it, not only on the account named in the file. This applies just as much to a personal inbox as to one you use for work.