Inside the Testgiveaway Combolist: How 27 Login Credentials Leaked

What HEROIC Analysts Found

In February 2026, HEROIC analysts reviewed a combolist file uploaded to Telegram under the name "15K Random ULOG Testgiveaway." Despite the "15K" in the file's label, HEROIC verified that it actually contained 27 usable records, pairing email addresses with plaintext passwords and the URLs of the sites those credentials belong to.

Why This Is Dangerous

Small sample files like this one are often shared for free as a "giveaway" or preview, a way for sellers to prove their larger lists work before charging for the full version. For the 27 people whose credentials are in this particular file, the risk is just as real as in a much bigger leak: the email, password, and site URL are all sitting together, ready for anyone to use.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

Whether a leak involves 27 accounts or 27 million, the underlying danger is the same: a working email and password pair, especially one that has been reused elsewhere, can let an attacker log directly into other accounts through credential stuffing. Free "giveaway" samples like this one are also often used to build trust before a threat actor sells a much larger version of the same list.

How Combolists Work

A combolist is a compiled file of username or email and password pairs, typically pulled together from older breaches, stealer logs, or leaked databases. Sellers on Telegram and similar platforms frequently release small "test" or "giveaway" combolists like this one to demonstrate that the credentials are genuine, hoping to attract buyers for a fuller, paid list built the same way.

Check If You Are Affected

If you want to know whether your email address appears in this combolist or any other leak, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records. Search your email now to see if you need to change any passwords.