Combolist
3 views

What Is a Combolist? How Attackers Build, Sell and Use Stolen Login Lists

By ScruteXPublished
On 10 November 2026, the Scrutex threat catalogue logged five new credential listings across two cracking forums in one day. One seller offered 1.4 million email and password pairs labelled "fresh" and "private". Another posted 1.3 million pairs sorted for Steam, Valorant and Roblox accounts. A third shared a small file of Yahoo addresses, sorted by email domain. Each of those files is a combolist, and each one exists for the same job: logging into accounts that belong to someone else.
What is a combolist? A combolist is a text file of stolen login pairs, usually written as email:password, that criminals assemble to feed automated login tools. Each line is one "combo". Attackers load the file into a checker and try every pair against a target site, betting that people reuse passwords.
This guide covers where combolists come from, how they differ from breach dumps and stealer logs, how attackers use them, and the checks a security team can run this week.

What Is a Combolist, Exactly?

"Combo" is short for combination: a login identifier and the password that goes with it. That pairing is what makes the file useful for account takeover.
Combolists come in three common formats:
The first two formats tell an attacker nothing about where a password works. The third does. ULP stands for URL, login and password. Each line names the site the credential belongs to, so the attacker skips the guessing step. Most ULP files start life as infostealer output, which makes them fresher and more targeted than a plain email list.
A combolist is different from the data a company loses in a breach. A breach dump is raw material. A combolist is a weapon built from it. Someone has already removed duplicates, cracked weak password hashes, fixed the formatting and often sorted the lines for a particular target.

Combolist vs Breach Dump vs Stealer Log

Analysts see all three in the same forums and Telegram channels, and the labels get mixed up. The differences matter because each one calls for a different response.
That split drives triage. A plain combo forces the attacker to guess which services the password opens, and most guesses fail. A stealer log hands over the site, the password and often a live session cookie. Catching a credential at the stealer log stage gives you the chance to revoke the session before anyone uses it.

How Attackers Build a Combolist

Combolists are produced, not found. The process runs in five stages.
1. Collect raw material. Inputs include breach dumps, phishing kit output, exposed databases and stealer logs. Infostealer families such as Lumma, Vidar and RedLine pull saved browser logins, cookies and autofill data from infected machines.
2. Crack and clean. The builder cracks weak password hashes, reformats every line to one standard and strips duplicates.
3. Sort for a target. Sellers split lists by email provider, country, industry or service. The 10 November listings show this in practice: one file sorted to Yahoo addresses only, two files built for gaming platforms. A file sorted to a single corporate email domain is the version a security team should worry about most.
4. Check. Some sellers run the list against a live service first and keep only the working pairs. One of the 10 November listings advertised 130,000 pairs as "validated". Checked lists sell for more because the buyer skips the noisy, detectable stage of the attack.
5. Relabel and resell. "Fresh", "private" and "HQ" are sales labels, not facts. On 11 November, the Scrutex catalogue recorded the same 6,300-line Hotmail file on two different forums under two different seller names, and both posts called it validated. Old pairs get mixed into new files all the time, and large compilations are usually older lists merged together.
The result is a division of labour. Some actors only collect and clean credentials. Others only buy and use them. The volume shows up in our own data: the Scrutex threat catalogue holds more than 45,000 listings matching the term "combolist".
Analyst note: treat a seller's "fresh" claim as unverified. Before escalating, compare a sample of the lines that match your domain against breach data you already hold. If every matched pair appears in an old dump, the urgency drops. If the passwords are new to you, assume a recent infostealer infection or phishing compromise and treat it as live.

Where Combolists Are Traded

Most combolists move through three channels.
Cracking forums. Sellers post free samples to build reputation, then sell larger or "private" files. Free files get copied and reposted, so a free combolist can reach more attackers than a paid one.
Telegram channels and log clouds. Some channels sell monthly subscriptions to a running feed of stealer output. Subscribers then cut their own combolists from the feed.
Exposed cloud storage. Criminals store large compilations in databases and storage buckets they fail to secure. These leaks surface briefly, get copied, and spread further.

How Attackers Use a Combolist in Credential Stuffing

Credential stuffing is the attack combolists exist for. MITRE ATT&CK tracks it as T1110.004 (Credential Stuffing), and successful logins become T1078 (Valid Accounts). OWASP lists it as automated threat OAT-008.
The attacker needs four things: the combolist, a tool, a target config and a way to hide. OpenBullet, its rewrite OpenBullet 2 and forks such as SilverBullet are widely used for this work. A config tells the tool how one specific login page behaves: which fields to fill, what a failed login looks like, what a success looks like. Residential proxies matter most for defenders. Each attempt can arrive from a different home IP address, which defeats simple IP rate limits. CAPTCHA solving services handle the rest.
Most of this traffic looks like normal failed logins. A stuffing run tries one password per account, spreads attempts across thousands of IPs and runs at a pace that sits under lockout thresholds. Teams that only alert on account lockouts rarely see it.
What happens after a hit depends on the account. Attackers drain consumer accounts of loyalty points, stored balances and gift cards, or resell them whole, and they configure their tools to flag accounts that hold cash or points. Corporate accounts (VPN, SSO, webmail) go to initial access brokers, or the attacker uses them directly to move into the network.

Why One Stuffed Account Can Cost More Than It Looks

The number of accounts an attacker takes over does not decide the damage. What each account can see decides it.
A customer account that can view only its own profile limits the loss to one person. A customer account that can view linked family members, shared workspaces or team directories exposes everyone it connects to. Most of those people never reused a password. They lose data because someone they are linked to did.
Corporate accounts follow the same rule. A stuffed webmail account with no MFA gives the attacker a mailbox to read and a trusted address to phish from. A stuffed SSO account opens every application behind it. When you score a credential exposure, start with what that account can reach. Whose account it is comes second.

How to Defend Against Combolist Attacks

Defence splits into two problems. Your workforce logins (SSO, VPN, email) and your customer logins need different controls.

Workforce accounts

Put phishing-resistant MFA on every external login. A combo alone fails against a second factor. Passkeys and FIDO2 keys close the gap that SMS codes leave open.
Treat stealer-log hits as worse than combo hits. Infostealers take session cookies, which can bypass MFA. When a corporate address appears in a stealer log, reset the password, revoke active sessions and check the device. The device may be a personal laptop where an employee also signs in to work apps.
Block known-compromised passwords. NIST SP 800-63B tells verifiers to screen new passwords against lists of compromised values. Apply this at set and reset time.
Monitor leaked sets for your domain. Route each hit into a ticket with a named owner and a due date.

Customer accounts

Rate limit on more than IP address. Residential proxies spread attempts across thousands of IPs. Use device fingerprints, login failure ratios and username spread per session.
Watch for stuffing signals. A spike in failed logins across many usernames, a high failure ratio from one network, or a successful login followed within minutes by a profile change or points redemption.
Notify matched customers. If a customer's email appears in a fresh combolist, force a reset and tell them why.

Regulatory context

Credential stuffing that succeeds is a reportable incident in several jurisdictions. India's CERT-In directions of April 2022 require organisations to report cyber incidents, including unauthorised access to systems, within six hours of noticing them. APRA CPS 234 requires Australian regulated entities to notify APRA within 72 hours of becoming aware of a material information security incident. India's Digital Personal Data Protection Rules add a duty to notify the Data Protection Board and each affected person of a personal data breach once the data fiduciary obligations take effect on 13 May 2027. Teams preparing for that date need a record of when they first saw an exposure and what they did about it.

A fair view of the tools

No single tool covers this. Bot management and WAF products stop the login flood at the door, and large consumer platforms need them. Identity providers enforce MFA and session controls. Free breach lookup services let a small team with one domain run a first check at no cost.
External exposure monitoring answers a different question: which of your credentials are already in circulation, and how fresh are they, before anyone tries them at your login page? Mature teams often run each of these as a separate tool. Smaller teams usually need the exposure view tied to the rest of their external risk (lookalike domains, exposed services, vendor leaks) so one analyst can act on it.

Key Takeaways

  • A combolist is a cleaned, formatted file of stolen login pairs built for automated login attacks. It is a product made from breach dumps and stealer logs.
  • ULP lists (URL, login, password) come from infostealers and tell the attacker where each password works. Treat them as more urgent than plain email lists.
  • Sellers sort, check and relabel lists. "Fresh" and "validated" are sales claims to verify, not facts.
  • Stuffing traffic hides inside normal failed logins. Lockout alerts alone will not catch it.
  • The damage from a stuffed account depends on what that account can reach.

Am I Exposed?

Run these checks this week. None of them need Scrutex.
  • ☐ Search your corporate email domain in a free breach lookup service, including any stealer log results. Note how many addresses appear and the dates.
  • ☐ Pull 30 days of SSO and VPN logs. Look for days where failed logins across many usernames spike, or one network produces a high failure ratio.
  • ☐ Confirm every externally reachable login (SSO, VPN, webmail, admin panels, customer portal) enforces MFA. List the ones that do not.
  • ☐ Check whether your password policy blocks known-compromised passwords at set and reset time.
  • ☐ Check whether a password reset in your environment also revokes active sessions. If it changes the password and leaves sessions alive, a stolen cookie still works.
If you could not answer the second or third item with confidence, start there.

What Scrutex Finds Here

Scrutex Data Exposure Insights watches dark web forums, paste sites, Telegram channels and stealer logs for credentials tied to your domains. It flags corporate email addresses that appear in combolists and stealer logs, with the source type and the date the listing first appeared. It separates stealer-log exposures, where you need to revoke sessions and check a device, from recycled combo exposures, where a forced reset is usually enough.
Scrutex sees credentials once they surface in a source it collects. A private list held by one crew and never shared stays invisible until it appears somewhere. Scrutex also does not block login attempts at your login page. That is the job of your identity provider, MFA and bot management.

What That Looks Like

Sample alert, redacted. Field names simplified.

Check Your Domain

Are your company's email addresses sitting in combolists and stealer logs right now? Add your domain to a free Scrutex account and see. It takes a work email and a domain. No credit card, no agent. Check your domain

Where to Go Next

FAQ

What is a combolist? A combolist is a text file of stolen username or email and password pairs, formatted one pair per line, that attackers load into automated tools to try logins on many sites. Criminals build them from breach dumps and infostealer logs, then clean and sort them for credential stuffing.
What is the difference between a combolist and a stealer log? A stealer log comes straight from malware on an infected device and usually includes the website, login, password, cookies and device details. A combolist is a processed file, often merged from many sources, that typically holds only the login pair. Stealer logs are usually fresher and riskier because session cookies can bypass MFA.
What does ULP mean in a combolist? ULP stands for URL, login and password. Each line names the exact website the credential belongs to, so the attacker does not have to guess where a password works. ULP files usually come from reformatted infostealer output.
How do I know if my email is in a combolist? Individuals can search their email address in a free breach lookup service. Organisations need monitoring that watches forums, Telegram channels and stealer logs for their domains and alerts on each new hit.
Can MFA stop credential stuffing? MFA stops most stuffing attacks because a stolen password alone is not enough to log in. It does not stop session hijacking from infostealer cookies, so teams also need to revoke sessions when a stealer log exposure appears and block known-compromised passwords.
Back to all posts