: A "combo list" (combination list) is typically a .txt file formatted as email:password .

: Using these lists to access accounts without permission is a direct form of identity theft. Essential Security Guide (Prevention)

: These lists are compiled from multiple sources, including past data breaches , phishing campaigns, and malware like infostealers.

Downloading and using "combo lists"—collections of stolen email and password pairs—is under most international data protection laws, including the Computer Fraud and Abuse Act (CFAA) and GDPR. These lists are primarily used by cybercriminals for credential stuffing attacks and account takeovers.

: Possessing or sharing unauthorized credentials can lead to criminal charges.