One File, 542 Records: Inside the ‘500 mix’ Telegram Combolist

In August 2025, HEROIC analysts found a file named 500 mix uploaded by a Telegram user, containing 542 records of email addresses and plaintext passwords compiled from multiple sources. Why This Is Dangerous: Even at a modest size, this file contains complete, ready-to-use login pairs stored in plaintext. There is no cracking required, an attacker can start testing these 542 credentials against other sites the moment the file is downloaded. What Was Exposed: - Email addresses - Plaintext passwords - URLs tied to each login Why This Matters: Small combolists like 500 mix are frequently combined with other files to build larger credential stuffing lists. If you reuse passwords across multiple accounts, a leak this size can still expose far more than the 542 accounts listed here. How This Combolist Works: Files labeled mix are usually assembled from smaller batches of stolen credentials pulled from various breaches and stealer logs, then combined into a single list for easier distribution and resale. Check If You Are Affected: Check your email and passwords against HEROIC's free breach scanner, which searches more than 400 billion exposed records, to see if you are part of this or any other leak.