The RandomWorkingSMTPs Dump Exposed 72 Working Email Server Logins

HEROIC analysts identified a file named RandomWorkingSMTPs uploaded to a Telegram channel in July 2026. Unlike a typical combolist of website logins, this file contains 72 records of email addresses, plaintext passwords, and URLs specifically tied to working SMTP mail servers, the systems used to send email. Why This Is Dangerous: Working SMTP credentials let an attacker send email through a legitimate mail server rather than their own. That means phishing emails, malware links, and spam sent using these accounts can slip past spam filters more easily because they are coming from a real, previously trusted source. The passwords are also stored in plaintext, so no cracking is required before they can be used. What Was Exposed: - Email addresses - Plaintext passwords - URLs for the associated mail servers Why This Matters: Even a small list of 72 working SMTP logins is valuable to spammers and phishing operators, who can use each one until it gets flagged or shut down. If any of these credentials belong to you or your organization's email infrastructure, attackers could send convincing phishing messages that appear to come from your own domain, damaging your reputation and putting your contacts at risk. Reused passwords tied to these accounts could also open the door to broader account takeover. How a Combolist Like This Works: This type of list is compiled by testing large batches of leaked or guessed email and password combinations against SMTP servers to find which ones still log in successfully. Only the working pairs, 72 of them here, make it into the final file. Attackers then trade or sell these verified credentials on Telegram because a confirmed working login is far more valuable than an untested one. Check If You Are Affected: Run a free scan against HEROIC's database of more than 400 billion breached records to see if your email address shows up in this leak or any other. If you manage a mail server, review your SMTP account activity for unusual login attempts and change any password that may have been reused.