Dark Web Intel: 99,633 Credentials From the User Pass Part 5.2 Dump

HEROIC analysts picked up a combolist called User pass part 5 2 while monitoring dark web channels for newly circulated credential dumps. A Telegram user uploaded the file, which contains 99,633 records pairing email addresses with plaintext passwords and the URLs those logins were tied to. The data traces back to January 2023, and the "part 5 2" naming suggests this file is one segment of a much larger combolist that was split into pieces before being shared.

Why This Is Dangerous

With passwords stored in plaintext, an attacker who obtains this file does not need to spend any time or computing power cracking anything. Each of the 99,633 email and password pairs can be tested directly against the listed URL, and against other popular sites, using freely available automated tools. Splitting a large combolist into numbered parts, as this one appears to be, also makes it easier for buyers to purchase and process the data in manageable chunks.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Nearly 100,000 credential pairs is enough volume to power a serious credential stuffing campaign, where automated tools rapidly test stolen logins against many websites at once. If this file is truly one part of a larger series, the total number of people affected across all the segments could be significantly higher than the 99,633 in this piece alone. Anyone whose email and password appear here faces real risk of account takeover on any service where the same password was reused.

How Combolists Work

A combolist is a plain text file of login pairs, typically formatted as email:password, compiled from sources such as phishing pages, malware infections, and older data breaches. Large combolists are frequently broken into numbered parts, like "part 5 2" here, so they are easier to upload, download, and trade across Telegram channels and forums without hitting file size limits. Buyers often collect every part of a series to reconstruct the full original dataset.

Check If You Are Affected

To find out if your email address appears in this combolist, or in any related parts of the same series, run a free scan with HEROIC's breach checker. It searches more than 400 billion compromised records, giving you a fast way to see if your credentials have been exposed and need to change.