One Upload, One File: 183,370 Accounts in the Arabic Base Leak

One Telegram upload. One combolist file. 183,370 exposed accounts. HEROIC analysts identified a combolist named "ARABIC BASE NEW" uploaded to a Telegram channel on March 4, 2023. The file contains 183,370 records, each pairing an email address with a plaintext password and the URL the login was used on, with the naming suggesting a focus on Arabic-language accounts. Why This Is Dangerous: Every one of these 183,370 records is a ready-made login attempt, requiring no password cracking or guesswork. An attacker only needs to automate requests against the listed URLs to start testing which accounts still accept the exposed password. What Was Exposed: Email addresses. Plaintext passwords. URLs identifying the site or service tied to each credential pair. Why This Matters: A leak of this size gives attackers enough volume to run large-scale credential stuffing campaigns, and anyone who reused a password from this list on another account, whether email, banking, or social media, risks having that account compromised too, potentially leading to financial fraud or identity theft. How a Combolist Like This Gets Made: Regionally labeled files like this one are typically assembled by filtering a larger pool of stolen credentials, often sourced from stealer malware or older breaches, down to accounts matching a specific language or region, then packaged and circulated on Telegram under a descriptive name to attract targeted buyers. Check If You Are Affected: HEROIC's free breach scanner checks your email against more than 400 billion leaked records. Run a scan today to see if your login is part of this 183,370-record file.