Combo List Generation - From Raw Data to Credential Stuffing
1. What Makes a Good Combo List?
A combo list is only as good as its hit rate. Raw dumps with 10M lines at 0.01% validity are worthless. A curated list of 10k combos with 15% hit rate is gold.
- Freshness: Last 30 days: 15-25% hit rate. 30-90 days: 5-10%. Over 90 days: below 2%.
- Source diversity: Single-breach lists are predictable. Cross-referencing catches password reuse.
- Deduplication: 50M lines with 80% duplicates wastes automation tools. Always dedupe.
- Validation: Valid email format + reasonable password length = higher hit rates.
- Target specificity: Netflix combos vs Coinbase combos = different markets.
2. Data Sources
Public Archives: HIBP API (hashes for cross-reference), IntelX/LeakCheck/Dehashed (paid APIs), Snusbase, RaidForums archive, BreachForums dumps.
Telegram: Channels like @combo_daily, @leaks_online, @fresh_combos with daily updates.
Automated: Pastebin scraping (real-time), Ghostbin/Rentry.co monitoring, dark web forum crawlers, GitHub gist monitoring.
3. Processing Pipeline
Code:
#!/bin/bash
RAW="./raw"; PROC="./processed"; WORK="./work"
mkdir -p $RAW $PROC $WORK
for f in $RAW/*.txt $RAW/*.csv; do
cat "$f" | tr ";|\t" ":" | tr -d "\r" >> $WORK/norm.txt
done
grep -E "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}:.{6,}" $WORK/norm.txt > $WORK/valid.txt
sort -u $WORK/valid.txt > $WORK/deduped.txt
echo "Valid: $(wc -l < $WORK/valid.txt)"
echo "Unique: $(wc -l < $WORK/deduped.txt)"4. Hit Rate Optimization
- Freshness window: Under 30 days = 15-25% hit rate
- Sort by email domain. Gmail combos work on Google services
- Users append numbers when changing passwords (Password1 -> Password2). Cluster these patterns.
- Same email + same password in 3+ breaches = highly likely still active
- Remove combos from known credential stuffing blacklists
5. Pricing Guide
- Raw dump: $5-20 per million lines
- Normalized + deduped: $20-50 per million lines
- Domain-sorted + validated: $50-150 per million lines
- Fresh (<30d, targeted): $200-500 per 100k lines
- Premium (high-value, verified 24h): $1000+ per 10k lines
6. OpSec for Combo Dealers
- Never host combo files on personal servers
- Use dead drops (file.io, temp.sh) with auto-expiry
- Encrypt with AES-256 before upload
- Use Monero only, never Bitcoin
- Watermark with 0.1% unique entries to catch leakers
- Rotate Telegram handles monthly
Good combos are the lifeblood of credential stuffing. Process them right and your hit rate will make you rich.