The Mansory 18 Combolist Leaked 58,149 Logins of Unknown Origin

HEROIC analysts identified a combolist labeled Mansory 18 that a Telegram user uploaded in December 2025. The file contains 58,149 records pairing email addresses with plaintext passwords, along with the URLs of the sites where each credential was used. The name does not correspond to any company or platform we could independently verify. The number 18 suggests this is one entry in a numbered series the uploader has released over time, rather than a reference to a single breached business. Why This Is Dangerous: Every password in this file is stored in plaintext, so anyone who downloads it can use the email and password pairs immediately, with no cracking or decoding required. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each account Why This Matters: Even without a confirmed source company, the accounts in this file are real. If any of these passwords are reused elsewhere, an attacker can use them for credential stuffing against email, banking, or shopping accounts, which leads directly to account takeover, identity theft, and financial fraud. How a Numbered Combolist Series Like This Works: Sellers on Telegram often release combolists in numbered batches, building a track record of new drops over time to attract repeat buyers. Each batch typically pulls together credentials from a mix of phishing pages, malware infections, and older leaks rather than one single hack, and the label attached to it, in this case Mansory, is often just a name the uploader chose rather than the name of a breached company. Check If You Are Affected: HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including combolists like this one. Run a scan to see if your credentials are part of this exposure and get clear steps to secure your accounts.