308,281 Mail Access Records Leaked by moon_supp1 on Telegram

Mail Access Combolist by moon_supp1: 308,281 Records Exposed

HEROIC analysts identified a combolist labeled "mail acces by moon_supp1" that a Telegram user uploaded on 30 April 2025. The file contained 308,281 records pairing email addresses with plaintext passwords, along with associated URLs pointing to the mail services each credential unlocks.

Why This Is Dangerous

Because every password in this list sits in plaintext, an attacker can log straight into email accounts the moment they get the file, no cracking required. Email access is especially dangerous because inboxes are used to reset passwords everywhere else, meaning one compromised mail account can quickly unlock banking, shopping, and social media logins tied to the same address.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

With over 308,000 mail account credentials in circulation, this leak is large enough to power widespread credential stuffing. Because so many people reuse passwords across services, a single leaked email-and-password pair can lead straight to account takeover, financial fraud, or identity theft on accounts that have nothing to do with the mail provider the credentials first unlocked.

How Combolists Work

A combolist bundles email-or-username-and-password pairs, usually collected from earlier breaches, phishing campaigns, or malware infections, then packaged for sale or free release, often by a specific uploader or handle like "moon_supp1." Criminals load these lists into automated tools that test every pair against login pages at scale, relying on password reuse to make a percentage of them work. Telegram has become a preferred channel for this kind of distribution because uploads are instant and difficult to police.

Check If You Are Affected

Mail account access is one of the most valuable things an attacker can obtain, so checking your exposure matters. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this combolist, so you can find out in seconds whether your email credentials are circulating and secure your inbox before someone else gets to it first.