The SMTPs Leak Quietly Appeared on the Dark Web With 1,664 Logins

HEROIC analysts have identified a combolist file called “SMTPs uploaded by a Telegram User,” which surfaced on Telegram on February 21, 2026. The file contains 1,664 records tied primarily to accounts in the United States, pairing email addresses and usernames with plaintext passwords and the URLs those credentials unlock.

Why This Is Dangerous

The name of this file, SMTPs, points to email server credentials rather than ordinary website logins. Access to an SMTP account lets an attacker send email through that server, which can be used to send convincing phishing messages, spread malware, or impersonate a real business. Because the passwords are stored in plaintext and matched to specific URLs, anyone who obtains this file can attempt to log in right away.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each set of credentials

Why This Matters

If any of the 1,664 accounts in this file were reused on other services, attackers can attempt credential stuffing to break into personal or business accounts elsewhere. Compromised SMTP access in particular can let an attacker send fraudulent emails that appear to come from a trusted source, which raises the risk of further identity theft and financial fraud for anyone who receives those messages.

How Combolists Work

A combolist is a compiled file of email or username and password pairs, often pulled from earlier breaches and stealer logs and organized into one list. Criminals trade combolists like this one because the format makes it simple to test each pair automatically against login pages. The SMTPs file follows this pattern, bundling 1,664 credential pairs together with the URLs needed to use them immediately.

Check If You Are Affected

To find out if your email address is part of this leak or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records. Run a scan now and update any passwords you have reused across multiple accounts.