The ScroogeUrl Combolist Leaked in June, 222,157 Records Now Public

In June 2026, HEROIC analysts identified a combolist circulating through a Telegram channel under the label "VIP ULP DUMP." The file contained 222,157 lines of stolen login data, each one pairing an email address with a plaintext password and the web address (URL) where that login was originally used. Unlike a breach tied to a single company, this dump appears to be a compiled collection pulled together from multiple sources and repackaged for sale or free distribution among cybercriminals.

Why a Plaintext Password Combolist Is So Dangerous

The word "plaintext" is the key detail here. These passwords were not hashed, salted, or scrambled in any way, they are stored exactly as the victim typed them. That means anyone who downloads this file can immediately try logging into the paired email address and website without needing to crack or decode anything. Combined with the fact that each record already lists the exact site the credentials belong to, an attacker can skip straight to testing the account instead of guessing where else to try it.

What Was Inside the ScroogeUrl Combolist

• Email addresses (used as usernames)
• Plaintext passwords, stored in unencrypted, readable form
• URLs identifying the exact website or service each login was captured from

Why Reused Passwords Make This Worse

Most people reuse the same password, or close variations of it, across several accounts. That habit is exactly what makes combolists like this one so profitable for criminals. Attackers feed these email and password pairs into automated tools that quietly test the same login on banking sites, email providers, and social media platforms, a technique known as credential stuffing. When a match hits, the result can be a drained bank account, a hijacked email inbox, or a social media profile used to scam friends and contacts. Because the URLs are already attached, attackers don't even need to guess which services to target first.

How Combolists Like This One Get Built

A combolist is not a hack of one specific company, it's a compilation. Criminals gather login credentials from older breaches, phishing campaigns, and malware-infected computers, then merge and clean the data into a single organized file. These lists get traded, sold, and re-uploaded across Telegram channels and dark web forums, often labeled with tags like "VIP" or "ULP" (a shorthand for URL, login, password) to advertise their usefulness to buyers. Because the data is pulled from many different original sources, a single combolist can contain credentials tied to hundreds of unrelated websites.

Check If Your Email Is In This Combolist

If you've reused a password across multiple sites, there's no reliable way to know just by memory whether your credentials ended up in a dump like this one. HEROIC's free dark web breach scanner checks your email address against a database of more than 400 billion leaked records, including combolists like this one, so you can find out quickly and change any exposed passwords before they're used against you.