Dark Web Intel: The Spain 13 Combolist Leaked 117,496 Credentials

What HEROIC Analysts Found

As part of ongoing dark web monitoring, HEROIC analysts identified a combolist called "Spain 13" that was uploaded to a Telegram channel on February 18, 2023. The file contains 117,496 records pairing email addresses with plaintext passwords and the URLs of the accounts they access.

Dark web intelligence like this matters because it shows exactly what's circulating before it reaches wider criminal use. In this case, that means over 117,000 working email and password pairs, stored in plain text, ready for anyone who gets a copy of the file to try logging in directly.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated accounts

Why This Matters

Combolists like Spain 13 are the raw material for credential stuffing campaigns, where attackers use automated tools to test each pair against major websites and services. If your password from this leak has been reused anywhere else, you're exposed to the risk of account takeover, identity theft, and financial fraud.

How Dark Web Combolists Like This Circulate

Files like Spain 13 typically move through private Telegram channels and dark web forums before becoming widely known, compiled from multiple smaller leaks and malware logs into one large, easy-to-use file. Tracking these dumps as they surface is how HEROIC identifies exposures before they're widely exploited.

Check If You Are Affected

With 117,496 records in this file, checking your exposure is quick and free. HEROIC's breach scanner searches more than 400 billion leaked records, including the Spain 13 combolist, so you can confirm whether your credentials were part of it and act before someone else does.