Our Analysts Found 822,494 Logins in a ‘URL Login Pass’ Dump

On 17 April 2026, HEROIC analysts identified a combolist titled "1M URL LOGIN PASS" circulating on Telegram. Despite the "1M" in its name, the file was found to contain 822,494 records of email addresses, plaintext passwords, and associated URLs, still a massive exposure even short of the advertised million.

Why This Is Dangerous

At more than 822,000 entries, this combolist gives attackers enormous scale. Automated tools can run through every record in minutes, testing each email and password pair against login pages across the internet. Because the passwords are plaintext, there's no cracking step standing between the file and a working account.

What Was Exposed

The "1M URL LOGIN PASS" combolist contains:

• Email addresses
• Plaintext passwords
• Associated URLs (the login pages the credentials were harvested from or tested against)

Why This Matters

A list of this size all but guarantees widespread password reuse among its victims. Attackers rely on combolists like this one to run large-scale credential stuffing campaigns, and anyone included faces a real risk of account takeover, followed potentially by financial fraud or identity theft if the compromised account holds any personal or payment information.

How This Combolist Was Built

Combolists this large are typically stitched together from many smaller sources, older breaches, phishing operations, and stealer malware output, then bundled and rounded up in the file name to make the offering sound bigger and more impressive to buyers. The gap between the claimed "1M" and the actual 822,494 records is a common pattern in this trade.

Check If You Are Affected

With over 822,000 records in this single combolist, the odds of being included are real. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this file, so you can find out and act quickly.