If you have ever wondered how attackers break into accounts at scale without any clever exploit, the answer is usually a combolist. It is one of the most mundane tools in the criminal toolkit and also one of the most effective. Understanding what a combolist is, where it comes from, and how it gets used will tell you a lot about why old passwords keep causing new incidents.
What Is a Combolist?
A combolist (short for combination list) is a plain-text file containing large numbers of credential pairs, usually in the format email:password or username:password, one per line. A single combolist can hold anywhere from a few thousand to many millions of entries.
Combolists are not the product of a single hack. They are aggregated. Operators collect credentials from many different sources, merge them, deduplicate them, and resell or redistribute the result. The sources typically include:
- Old data breaches — database dumps from previously hacked websites and services.
- Infostealer logs — plaintext passwords harvested directly from infected devices.
- Phishing campaigns — credentials typed into fake login pages.
- Previous combolists — new lists are often just old lists recombined and refreshed.
The result is a commodity. Combolists get traded, sold, and leaked freely across forums, chat channels, and file-sharing sites. Many are available for little or no money, which is exactly why they are so widely used.
Why Combolists Are Dangerous: Credential Stuffing
A combolist on its own is just a text file. What makes it a weapon is credential stuffing.
Credential stuffing is an automated attack. The attacker takes a combolist and feeds it into tools that try each email:password pair against a target login page, one after another, at high speed. The underlying bet is simple and statistically sound: people reuse passwords.
If someone used the same password on a forum that was breached in 2021 as they use on a business application today, then an attacker holding that old credential pair can log straight in. The attacker does not need to break any cryptography or find any vulnerability. They are using the correct password, simply obtained from somewhere the user forgot about.
A typical credential-stuffing operation looks like this:
- Load a combolist of millions of pairs into stuffing software.
- Route attempts through large pools of proxies to dodge rate limiting and IP blocks.
- Test the pairs against a target service automatically.
- Collect the small percentage that succeed into a new, higher-value "validated" list.
Even a success rate of a fraction of one percent is profitable at scale. Against a list of a million pairs, that is still thousands of working logins.
From a Single Reused Password to Account Takeover
The danger is not one compromised account. It is the chain reaction that follows, known as account takeover (ATO).
Once an attacker has a valid login, they can:
- Pivot to other services. They retry the same credentials elsewhere, because people who reuse a password usually reuse it in many places.
- Harvest more data. An inbox or SaaS account often contains the information needed to reset other accounts.
- Commit fraud or theft directly within the compromised account.
- Use the account as a trusted launch point for phishing coworkers, customers, or partners.
For an organization, one employee's reused personal password can become the entry point for a far larger incident. The initial credential might be years old and feel irrelevant, but attackers do not care how old it is as long as it still works.
Combolists vs. Infostealer Logs
These two data sources overlap and are often confused, but the distinction matters:
- A combolist is a flat, aggregated list of credential pairs. It is broad, cheap, and frequently stale.
- An infostealer log is a rich, structured capture from one infected device, including plaintext passwords and live session cookies, autofill data, and a map of the applications that device could access.
Infostealer logs are often fresher and far more dangerous, because they can bypass MFA through stolen sessions. But their passwords also feed straight into the combolist economy, so the two are deeply linked. Credentials that start life in a stealer log frequently end up, stripped down, in a combolist weeks later.
How to Defend Against Combolist-Driven Attacks
The good news is that the core defenses are well understood. The challenge is applying them consistently.
- Kill password reuse. This is the single most important control. Password managers that generate a unique, random password per site break the central assumption of credential stuffing. If every password is different, an old leaked pair is worthless everywhere except the one place it came from.
- Deploy multi-factor authentication. MFA stops most stuffing attacks cold, because a correct password alone is no longer enough. It is not perfect — stolen sessions can route around it — but against commodity combolists it is highly effective.
- Rate-limit and monitor logins. Combolist attacks are high-volume and noisy. Throttling attempts, watching for spikes in failed logins, and flagging impossible travel or unusual IPs will catch most campaigns.
- Screen against known-exposed passwords. Blocking passwords that already appear in leaked datasets prevents users from choosing a credential that is effectively pre-compromised.
- Know what of yours is already out there. If your domain's credentials already appear in circulating combolists, you want to find out before an attacker does and force a reset.
A Realistic Word on Visibility
It is important to be honest about coverage. Combolists are everywhere and constantly changing. No service can claim to see all of them — new lists appear daily, many circulate privately, and old ones get recombined endlessly. Any search of combolist and breach data captures a meaningful, actionable sample, not a complete census.
That is still extremely useful. Finding your domain in even one circulating list is a concrete signal that specific accounts need attention now. Treat a clean result as "nothing found in the sources we checked," not as proof that no credential of yours exists anywhere in the combolist ecosystem.
See What Is Circulating for Your Domain
darkweb-scanner checks your company domain against breach corpora and infostealer data to surface exposed credentials tied to your organization, then ranks what it finds by severity so you know what to fix first. We never access your systems — we only query data that has already leaked.
If you want to replace guesswork about password reuse with a concrete list of exposed accounts, run an exposure scan or sign in to get started.