Combolist

How it works

A combolist is a plain text file where each line holds an identifier and a password. Group-IB describes a combolist as stripping out every other field and merging credentials from many sources into plain login and password pairs. The sources include infostealer logs, database breaches from individual organizations, earlier combolists that are recycled, and even fake or autogenerated data mixed in with real credentials.

Because the origin is removed, a combolist cannot tell you which breach a pair came from or how old it is. Sellers label lists "fresh" or "private", but those labels rarely reflect actual recency or validity.

How it shows up in executive exposure

Combolists circulate on dark web forums, on Telegram channels and through file-sharing services. One well-known example, Collection #1, held 2,692,818,238 rows of email addresses and passwords, with 772,904,991 unique email addresses. Troy Hunt found it on the cloud service MEGA while it was also being shared on a hacking forum. It was built from thousands of earlier sources, and one file in it pointed to data from as far back as 2008.

For an executive, a combolist hit is hard to interpret on its own. The pair may be years old or may have been copied from a more recent leak. Attackers do not care about the origin. They run the list against login pages and see what works, which is why credential stuffing depends on it. EDG3 watches the dark web forums and Telegram channels where combolists are posted and sold, and links reposted copies back to the first post. WebThreat's CEM checks each executive's addresses against breach corpora and leak databases, so you see which leaked records tie to which leader. See what a combolist is and why the same data keeps reappearing.

How to reduce the risk

• Use multi-factor authentication. Group-IB notes that it stops a stolen password from being enough on its own, which removes most of what a combolist is worth.
• Use a unique password per service so a recycled pair works nowhere else.
• Trace an exposure to the original breach or infection, rather than judging it by the file that repackaged it.
• Reset passwords that appear in any list.

How it differs from related terms

A ULP list is a combolist with the website address added to each line. A stealer log comes straight from infected devices and carries more context, such as the device and the site. A breach corpus keeps provenance, which a combolist drops. For a side-by-side view, see combolists vs stealer logs vs database dumps.