: Trying the same username and password on hundreds of different sites, betting that the user has reused their credentials.
: Successfully logging into a victim's account to steal funds, personal data, or use the account for secondary phishing. Download 684K COMBO LIST UPDATE zip
Once a list is downloaded and extracted, attackers use automation to test these credentials against popular services (e.g., Netflix, Amazon, PayPal). : Trying the same username and password on
: Usually simple text ( .txt ) where each line is a login pair. : Usually simple text (
: Possessing or distributing stolen credentials is illegal under laws like the Computer Fraud and Abuse Act (CFAA) and GDPR .
A combo list is a massive text file compiled from multiple data breaches across various websites. Unlike a "raw" database leak from a single site, a combo list is a curated collection designed for high-volume automated attacks.
: Most "public" lists are "recycled" or "stale," containing passwords that users have already changed months or years ago. How to Protect Yourself