Dark Web Combo List

What Is a Dark Web Combo List?

A dark web combo list is a compilation of username or email and password pairs that have been leaked from various data breaches. The term "combo" refers to the combination of these credentials, which attackers use to gain unauthorised access to accounts. These lists are often compiled from multiple sources, including data breaches, phishing attacks, and malware infections, making them a valuable resource for cybercriminals.

For context, the Compilation of Many Breaches (COMB) dataset, released in early 2021, contained a staggering 3 billion email and password combinations, representing the largest organised credential compilation at that time[1]. Similarly, Collection #1-5 aggregated 2.2 billion credentials from years of breach data into searchable combo lists[1]. As of now, general public combo lists track over 12 billion records[2].

Some well-known examples of combo lists include:

• Antipublic: A notorious combo list that has circulated on various dark web forums.

• Mix 19.01: Another significant compilation that contains a variety of credential pairs from numerous breaches.

• CO Combolist: A well-documented list that offers a mix of usernames and passwords from different sources.

These lists are often used in credential stuffing attacks, where cybercriminals take stolen credentials and attempt to access multiple accounts across different platforms. With a success rate of 1% to 3%, even a small number of compromised credentials can lead to significant account takeovers[3][4].

To illustrate the risks, if an attacker possesses one million stolen credentials, they could potentially compromise between 10,000 and 30,000 accounts[3]. This vulnerability is exacerbated by the fact that 81% of users have reused passwords across multiple sites[4].

Understanding what a dark web combo list is and how it is compiled is crucial for recognising the potential risks to your online security.

How Combo Lists Are Created and Distributed

Combo lists are generated from various sources, primarily old data breaches, stealer malware, and phishing attacks. When a service is compromised, hackers often extract email addresses and passwords, which are then compiled into a list. For instance, Have I Been Pwned tracks over 1,044 breaches affecting 17.8 billion addresses, highlighting the scale of compromised data available[5].

Sources of Data

1. Old Breaches: Many combo lists originate from historical data leaks. The Compilation of Many Breaches (COMB) dataset, released in 2021, contained 3 billion email and password combinations[1]. Similarly, Collection #1-5 aggregated 2.2 billion credentials from years of breach data[1].

2. Stealer Malware: This type of malware is designed to harvest credentials from infected devices. Once a user's device is compromised, the malware can capture saved passwords and send them back to attackers.

3. Phishing Hauls: Attackers often use deceptive emails or websites to trick users into providing their credentials. Successful phishing attempts can yield large quantities of username and password pairs.

Aggregation Process

After gathering data, attackers aggregate multiple sources into a single list. This consolidation process increases the list's utility for credential stuffing attacks, where stolen credentials are tested across various platforms. For example, general public combo lists currently contain over 12 billion records[2].

Distribution Channels

Combo lists are typically shared on dark web forums and marketplaces. Attackers often exchange these lists or sell them to other criminals looking to exploit compromised credentials. Common file formats for these lists include .txt and .csv, making them easy to use with automated tools for testing credentials against multiple websites.

In summary, the creation and distribution of combo lists involve a systematic process of collecting compromised data from various sources, aggregating it, and sharing it on dark web platforms. Understanding this process can help you recognise the risks associated with your credentials being exposed.

How Attackers Use Combo Lists

Credential stuffing attacks are a common method used by cybercriminals to gain unauthorised access to accounts. These attacks leverage combo lists, which are compilations of stolen username and password pairs, often sourced from various data breaches. Attackers use automated tools to test these credentials across multiple websites simultaneously, significantly increasing their chances of success.

When a hacker acquires a combo list, they can employ credential stuffing tools to input thousands, or even millions, of username and password pairs. The average success rate for these attacks ranges from 1% to 3%[3][4]. This means that if an attacker has one million stolen credentials, they could potentially take over between 10,000 and 30,000 accounts. This is particularly effective due to the widespread issue of password reuse; studies show that 81% of users have reused passwords across multiple sites[4].

The end goal of credential stuffing is account takeover. Once an attacker gains access to an account, they can exploit it for various purposes, such as stealing personal information, making unauthorised purchases, or even selling access to the account on dark web forums. In fact, compromised credentials were the initial access vector in 22% of breaches reviewed in the 2025 Verizon Data Breach Investigations Report[6].

Why Password Reuse Makes Credential Stuffing Effective

Password reuse dramatically increases the efficacy of credential stuffing attacks. If a user has the same password across multiple accounts and one of those accounts is compromised, attackers can easily access the others. For instance, a university study found that attackers could successfully guess passwords for 32% of accounts linked to a university email address in a data breach[7].

To protect yourself, consider the following:

• Use unique passwords for each of your accounts to reduce the risk of unauthorised access.

• Enable two-factor authentication wherever possible to add an extra layer of security.

• Monitor your accounts for suspicious activity, especially if you suspect your credentials are on a combo list.

Understanding how attackers use combo lists can help you take proactive steps to secure your online presence.

Notable Combo List Breaches and Their Scale

Several high-profile data breaches have contributed to the vast number of credentials found in dark web combo lists. Here are some notable examples:

Antipublic Combo List

In 2019, the Antipublic Combo List emerged, containing over 1.4 billion records. This extensive compilation included email and password pairs from various data breaches, making it one of the largest collections available at the time. The sheer scale of this list highlights the risk posed to individuals who may have reused their passwords across multiple accounts[5].

Mix 19.01

The Mix 19.01 combo list surfaced with approximately 4.1 million pairs of usernames and passwords. This list includes credentials from multiple breaches, making it a valuable resource for cybercriminals conducting credential stuffing attacks. The specific origins of these credentials vary, but they collectively represent a significant threat to users who have not secured their accounts[1].

CO Combolist

Another noteworthy example is the CO Combolist, which contains around 488,000 records. This list is often referenced in discussions about compromised credentials on the dark web, showcasing the ongoing issue of data breaches and the risks associated with weak password practices[1].

'Good' Combolist

This smaller but still concerning combo list includes 1,978 credentials. While it may seem insignificant compared to the others, it serves as a reminder that even a limited number of compromised accounts can lead to serious security issues if attackers use them effectively[2].

Context and Implications

The accumulation of these combo lists reflects a broader trend in data breaches and the exploitation of compromised credentials. As of now, general public combo lists track over 12 billion records, emphasising the scale of the issue[2]. Credential stuffing attacks, which have a success rate of between 1% and 3%, can result in thousands of accounts being compromised from just a single stolen credential set[3][4].

To protect yourself, regularly check your credentials using services like Have I Been Pwned, which tracks over 17.8 billion pwned addresses[5]. Ensure you’re not part of this statistic by changing passwords immediately if you find your information in any combo list.

How to Check If Your Credentials Are on a Combo List

To find out if your credentials are on a combo list, start with “Have I Been Pwned.” This tool is widely recognised for checking if your email address has been involved in any data breaches. As of now, it tracks over 1,044 breaches affecting 17.8 billion compromised addresses[5].

How to Search by Email

1. Visit the Have I Been Pwned website.

2. Enter your email address in the search box.

3. Click “pwned?” to see the results.

If your email appears, it means your credentials have been exposed in one or more breaches. The results will show specific breaches and how your information was compromised. This can include details about the type of data leaked, such as passwords or usernames.

Understanding the Results

When you check your email, you might see a list of breaches. Each entry will provide context on how your data was compromised. For example, if your credentials were found in the Compilation of Many Breaches (COMB), it likely means they were part of a massive leak involving 3 billion email-password pairs[1].

Browser Extensions and Monitoring Services

To stay proactive, consider using browser extensions and monitoring services. These tools can alert you if your credentials appear in new breaches. Some popular options include:

• Password managers: Many offer breach monitoring features.

• Browser extensions: Some notify you when you visit sites where your credentials may have been compromised.

Difference Between Old Breaches and Active Threats

Be aware that not all breaches are the same. Old breaches might not pose immediate threats if you have changed your password since the incident. However, active threats could mean your credentials are still being used for credential stuffing attacks, which have a success rate of 1% to 3%[3][4].

It’s crucial to regularly update your passwords, especially for accounts linked to sensitive information. If you find your credentials on a combo list, take action immediately to secure your accounts.

What to Do If You Find Your Info on a Combo List

Discovering your information on a combo list can be alarming. You need to act quickly to protect your accounts. Here are the immediate steps you should take:

Change Your Passwords

Start by changing the passwords for any affected accounts. If your email or username appears on a combo list, it's essential to update your password to something unique and strong. Avoid using easily guessable information, and consider using a password manager to generate and store complex passwords.

Enable Two-Factor Authentication

Wherever possible, enable two-factor authentication (2FA). This adds an extra layer of security by requiring a second form of verification, such as a text message code or an authentication app, in addition to your password. This is particularly important for financial and email accounts where sensitive information is stored.

Check for Unauthorized Access

Monitor your accounts for any signs of unauthorized access or suspicious activity. Look for unfamiliar transactions, login attempts from unknown devices, or changes to your account settings. If you spot anything unusual, report it to the service provider immediately.

Prioritise Financial and Email Accounts

Focus on securing your financial accounts and email first. These are often the most critical because they can be used to reset passwords for other accounts. If a hacker gains access to your email, they may be able to reset passwords for other services linked to that email.

Create Unique Passwords Going Forward

To prevent future breaches, create unique passwords for each site you use. The average user reuses passwords across multiple sites, which can lead to a domino effect if one account is compromised[4]. A password manager can help you keep track of these unique passwords without the need to remember each one.

Summary Checklist

Before you finish, double-check your actions:

• ☐ Change passwords for affected accounts.

• ☐ Enable two-factor authentication.

• ☐ Monitor accounts for suspicious activity.

• ☐ Prioritise security for financial and email accounts.

• ☐ Create unique passwords for each site.

Taking these steps not only helps secure your accounts but also reduces the risk of future breaches. Remember, staying proactive is key in the ever-evolving landscape of online security.

Why Combo Lists Target Specific Industries

Certain combo lists are labelled according to the industries they target, such as dating, gaming, banking, and streaming. The rationale behind this classification lies in the perceived value of the accounts associated with these sectors. For example, banking accounts are considered high-value targets due to the sensitive financial information they contain, while gaming and dating accounts, although valuable, typically do not hold as much monetary worth. Thus, the value hierarchy often follows this order: banking > gaming > general.

In the United States, banking combo lists are particularly prevalent. Attackers focus on these lists because financial accounts can lead to substantial monetary gains. According to Akamai, around 3.4 billion credential stuffing attempts were aimed at financial services in 2020 alone[8]. Geographic targeting occurs as attackers often prefer to exploit accounts within the same region, making it easier to bypass security measures like two-factor authentication, which may be less stringent in certain areas.

Attackers seek high-value accounts because they yield greater rewards. For instance, a successful credential stuffing attack on banking accounts can lead to significant financial theft, whereas accessing a gaming account may only grant access to virtual items. The average success rate for these attacks hovers between 1% to 3%, meaning that even a small number of successful logins can result in substantial gains[3][4].

To illustrate, if an attacker has access to a combo list with one million credentials, they could potentially compromise between 10,000 and 30,000 accounts[3]. This motivation drives the creation and distribution of specialised combo lists, with attackers continuously seeking out the most lucrative targets to maximise their efforts.

In summary, the targeting of specific industries in combo lists is a strategic choice driven by the potential for high returns, particularly in the financial sector. Understanding these motivations can help you identify which of your accounts may be at risk and take appropriate action to secure them.

Key Takeaways

Finding your credentials on a combo list is serious, but manageable if you act now. Here's what matters most:

• Change passwords immediately on all affected accounts, prioritising banking and email—credential stuffing succeeds in 1% to 3% of attempts, so speed matters[3][4].

• Enable two-factor authentication on critical services; compromised credentials were the initial access vector in 22% of breaches[6].

• Stop reusing passwords—81% of users do this[4], which is why combo lists work so effectively across multiple sites.

• Check Have I Been Pwned regularly to monitor the 17.8 billion pwned addresses[5] and catch new breaches early.

• Use a password manager to generate unique credentials; only 49% of users keep distinct passwords[6], leaving the majority vulnerable.

If you're curious about how attackers find and distribute these lists in the first place, explore Unlocking the Secrets of Dark Web Search Services to understand the infrastructure behind credential trading.