Vuln_HestiaCP Combolist: 101 Server Logins Leaked on Telegram

Vuln_HestiaCP Combolist Leaks 101 Server Control Panel Logins

HEROIC analysts found a combolist titled "Vuln_HestiaCP," uploaded by a Telegram user on 15 July 2026. The file contains 101 records, each pairing an email address with a plaintext password and the URL of the server control panel the credentials belong to.

Why This Is Dangerous

HestiaCP is control panel software used to manage web servers and hosting accounts, so these aren't ordinary website logins, they're credentials that can grant access to entire servers. The "Vuln" in the file's name suggests these panels were found to be vulnerable or improperly secured, and because the passwords are stored in plaintext, anyone with this file can log in immediately.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs (server control panel addresses)

Why This Matters

Gaining access to a server's control panel can let an attacker view or steal every website, database, and email account hosted on that server, far more damage than a single compromised login on a typical site. For the 101 people or businesses in this file, the risk extends to anyone whose data lives on those servers, and any reused password opens the door to further credential stuffing attacks elsewhere.

How This Vulnerability-Based Combolist Was Built

Unlike combolists pulled from a single hacked database, this type of list is often assembled by scanning the internet for control panels with weak security, then testing common or previously leaked passwords against them until a match is found. The credentials that succeed are compiled into a file like this one and shared on Telegram, where other attackers can use them to access the same servers.

Check If You Are Affected

If you manage a HestiaCP server or any hosting control panel, or reuse passwords across your admin accounts, it's worth checking your exposure right away. HEROIC's free breach scanner searches a database of more than 400 billion leaked records to help you find out if your credentials appear in this or any other leak.