Combolist
A recycled email:password list compiled from old breaches and other people's logs, resold in bulk. The fast food of the credential economy: cheap, stale, everywhere.
Why it matters to you
Combolist hits inflate exposure numbers without telling you anything new. Insist on knowing whether a record is primary (from a log) or recycled.
Where we meet it
We deduplicate combolists against the primary stealer records they were built from and label them secondary, so they can be excluded from a search entirely. Vendors who cannot tell the two apart quote the combined number, because it is bigger.
Connected terms
Stealer log
The complete output of an infostealer infection: every saved browser password, session cookie, autofill record and crypto-wallet file from one victim machine, zipped into a single bundle.
Checker
A tool that tests stolen credentials against a target service in bulk and sorts the live ones from the dead. The industrialized step between a combolist and an account takeover.
Credential stuffing
Replaying credentials leaked from one service against every other service, at scale, on the assumption that people reuse passwords. The industrial use for every combolist and log ever sold.
Database dump
The raw export of a breached application's tables, traded whole before it is broken up into combolists. Structure intact: emails, hashes, addresses, order history, whatever the schema held.
Where this term stops being vocabulary
Sherlog is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the goods
Bank log
Access to a compromised online banking account, sold with the balance quoted in the listing. Priced as a fraction of what it holds, because the buyer still has to get the money out.
BIN
The first six to eight digits of a payment card, identifying the issuing bank, the country and the card product. Not stolen data in itself, but the index the trade is organised around: cards are advertised, sorted and priced by BIN.
Card dump
The magnetic-stripe data read off a payment card, sold for cloning into a physical one. Distinct from card-not-present data, priced higher, and slowly becoming a legacy good as chip and contactless spread.
Crypto drainer
A kit sold to fraudsters that empties a cryptocurrency wallet the moment its owner signs a transaction on a malicious site. The victim believes they are minting, claiming an airdrop or connecting to a service, and the signature they give away authorises transfer of everything.