Follow the Access · 24 — The Combolist: Credential Stuffing and the Afterlife of a Breach

Follow the Access — Case 24. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

The brute-force case, early in this register, watched an attacker guess. This case watches an attacker who does not guess at all, because he already knows. The credential he tries is not invented on the spot from a wordlist; it is a real username and a real password, harvested from a breach of some entirely different service, and he is replaying it here against this login on the wager that the person who chose it once chose it more than once. That is credential stuffing: the automated replay of breached username:password pairs against services unrelated to the breach that produced them, and it works — when it works — because password reuse is endemic, because the pair he is replaying is not a guess but a fact, true somewhere, and the only question is whether it is also true here. The raw material of this replay is the combolist: the aggregated file of breached pairs, compiled from countless separate breaches into one deduplicated commodity, and it is the subject of this case.

The honeypot beneath these words watches the replay with a clarity that few vectors afford, because the replay leaves a statistical signature that guessing does not. Look at what the honeypot's login prompt receives, and the most-attempted credential is a single pair — admin:123456 — tried five thousand three hundred and eighty-five times, and another — admin:admin — arriving from a hundred and thirty-six distinct source IPs, unrelated hosts scattered across the internet, all offering the identical pair. That is not a hundred and thirty-six attackers who independently, coincidentally, decided to try the same thing. That is one list, widely shared, being replayed by many hands — the fingerprint of a combolist in circulation, a small stable set of pairs arriving from a large unrelated population, which is precisely what replay looks like and precisely what independent guessing does not.

So the disposition is RESOLD, because the combolist is a commodity, and its whole nature is to be sold again. It is compiled from breaches, packaged with the tools and configs that aim it at a target, and traded, sold, and resold across forums and channels — the same list monetized across many buyers, each breached pair outliving the breach that produced it because reuse and non-rotation keep it valid somewhere, indefinitely. And the access it yields — the accounts the replay unlocks — is itself resold, and each fresh breach feeds the next compilation, so the victim of one breach becomes a line in the next list. This is the case about the afterlife of a breach: how a password leaked once is sold, replayed, and sold again, long after the breach that first exposed it has been forgotten by everyone except the market that keeps it in stock.

1. The Attacker Who Already Knows

Begin with what separates this vector from the brute-force case that superficially resembles it, because the distinction is the whole of the matter. Brute force guesses: it works through a wordlist of likely passwords, trying candidate after candidate in the hope that one matches, and its knowledge of the target is nil — it is throwing darts at a board it cannot see. Credential stuffing does not guess. It replays a specific username paired with a specific password, both of which are known to be real because they were harvested from an actual breach of an actual service, and the only uncertainty is not whether the password is real but whether the victim reused it here. The attacker is not throwing darts; he is trying a key he already possesses in a lock he hopes it also opens.

This difference is not academic; it changes the economics and the success rate entirely. Brute force against a strong, unique password is hopeless — the search space is too large, and the attacker will exhaust his wordlist without a hit. Credential stuffing against that same strong password succeeds instantly if the password was reused, because the attacker is not searching the space of possible passwords but replaying the one actual password the victim chose, wherever else the victim chose it. The strength of the password is almost irrelevant to stuffing: a long, complex, cryptographically excellent password, reused across two services and breached from one, is replayed against the other with perfect accuracy, and its complexity does nothing to stop the replay because the attacker is not guessing it — he is copying it. What defeats brute force, password strength, does not defeat stuffing, because stuffing does not attack the password's strength; it attacks its reuse.

The honeypot makes this concrete in the shape of what it receives. If the attacks were guessing, the credentials would sprawl — a wide, shifting variety of candidate passwords, each host working through its own wordlist. Instead they concentrate: a small, stable set of specific pairs, admin:123456 and admin:admin foremost, replayed identically from host after unrelated host. The concentration is the tell. A pair replayed five thousand times, arriving unchanged from a hundred and thirty-six different addresses, is a pair travelling on a list — passed from hand to hand, loaded into tool after tool, and replayed because it is on the list, not because each attacker independently reasoned his way to it. What the honeypot sees at its login prompt is not a thousand people guessing; it is one list, in wide circulation, being replayed by everyone who holds a copy. That is the vector's signature, and it is unmistakable once you know to look for the concentration rather than the volume.

2. The Combolist as Commodity

Now the object at the center of the vector, because the combolist is not a byproduct of the attack — it is a product, manufactured, packaged, priced, and sold, and understanding it as a commodity is understanding the vector. A combolist is an aggregated file of username:password pairs, compiled from many separate data breaches into a single deduplicated, formatted list. The individual breaches that feed it are of unrelated services — a forum breached one year, a retailer the next, a game, a mail provider, a social network — and the compiler's work is to merge their spilled credentials into one clean file, stripped of duplicates, formatted for the tools that will replay it. The scale is staggering and a matter of public record: the compilation known as Collection #1 held on the order of seven hundred and seventy-three million records; the aggregation dubbed RockYou2021 was reported to contain some eight and a half billion entries. These are not lists of a service's users; they are lists of humanity's reused passwords, drawn from everywhere at once.

What makes the combolist a commodity is that it is bought and sold, and not once but repeatedly. It circulates on underground forums, marketplaces, and Telegram channels, packaged and priced, and the same list is sold to many buyers — because a list, unlike a physical good, is not consumed by being sold; it is copied, and each copy sells again. A combolist compiled today is sold, and resold, and traded, and bundled into larger aggregations, and leaked freely once its commercial value has been extracted, at which point it seeds the next round of compilations. The market treats credentials exactly as a commodity market treats any fungible good: they are aggregated, graded, priced, and traded, with fresh lists commanding more than stale ones and targeted lists — pairs known to work against a specific service — commanding a premium over raw dumps. The breached password is not a secret that was lost; it is inventory, and there is a market that keeps it in stock.

Alongside the list, the market sells the means to replay it, which completes the commodity. Automated stuffing tools — Sentry MBA, OpenBullet, SNIPR are the widely-documented names — take a raw combolist and drive it against a target at scale, and they are configured for specific services by per-target configs, small files that teach the tool how to log in to this particular site, how to recognize a success, how to evade its defenses. The configs are themselves bought and sold, so that a buyer need not be technical: he purchases the list, purchases the config for the service he wants to attack, loads both into the tool, and runs a credential-stuffing campaign against a major service without writing a line of code or understanding a single protocol. This is the same commoditization the register saw with the access broker and the malware kit — the collapse of a skilled operation into a purchasable product — applied to the replay of breached credentials, so that the barrier to running a stuffing campaign is not skill but the price of a list and a config, both cheap, both resold, both waiting on a forum for whoever wants them.

3. Reuse Is the Whole Vulnerability

Now the human flaw the vector monetizes, because credential stuffing has exactly one prerequisite, and it is not technical — it is that people reuse passwords. Strip that away and the vector collapses: a breached pair replayed against an unrelated service fails, every time, if the victim used a different password there, because the pair is simply wrong for that service. The entire replay is a wager on reuse, on the near-certainty that the person who chose a password for one account chose the same password, or a trivial variant, for others — for their email, their bank, their work login, their cloud storage. The combolist is valuable, the tools are sold, the campaigns are run, all on the strength of this one durable fact about human behavior: that remembering many passwords is hard, and reusing one is easy, and so people reuse.

This is why the vector is so resistant to the defenses that work elsewhere in the register. The register has recommended, again and again, strong passwords — and against guessing, strength is decisive. But against stuffing, strength is beside the point, because a strong password reused is a strong password breached-and-replayed, unlocking every account where it was reused with the full accuracy of a correct credential. The vulnerability is not the weakness of any single password; it is the sameness across accounts, the fact that one credential is many accounts' credential. A user with a hundred accounts and one password has, in effect, one account with a hundred front doors, and the breach of any single door hands the attacker all hundred. Reuse converts the independent security of many accounts into the shared fragility of one, so that the compromise of the weakest, most trivial service in the user's life — a forum he signed up for once and forgot — becomes the compromise of his bank, if he used the same password for both.

The honeypot's data is the aggregate shadow of this human fact. Those hundred and thirty-six hosts replaying admin:admin, those five thousand replays of admin:123456, are the automated expression of the wager on reuse — the market's bet, placed millions of times a day across the internet, that somewhere the person who chose this pair chose it again. Most of the replays fail; the honeypot's login is a trap, and even against real targets the per-attempt success rate is low, typically a fraction of a percent to a couple of percent. But the wager does not need to win often. The list is cheap, the replay is automated and free to run at scale, and a single valid hit yields a real account — which can be drained, or used, or, in the closing of the loop, resold. Low success times enormous volume times near-zero cost yields profit, and the whole calculation rests on the reliability of reuse, which is why the vector persists: because the human tendency it exploits is as durable as human memory is limited, and shows no sign of changing.

4. RESOLD — The Afterlife of a Breach

Now the disposition, and the combolist earns RESOLD more literally than perhaps any other vector in this register, because being resold is not what happens to the access at the end — it is the nature of the commodity from the beginning. A breached credential, once compiled into a list, enters a market that sells it and sells it again: to the first buyer, then, because a copy costs nothing, to the second and the tenth; bundled into a larger aggregation and sold again; leaked when its fresh value is spent, seeding the compilations that will be sold next season. The pair does not get used up. It is inventory that replenishes by being copied, and its commercial life is a long chain of resales, each extracting a little more value from a credential the victim leaked once and, in most cases, never knew was gone.

The disposition names an afterlife, and the word is exact, because the credential outlives its breach by years. A password leaked in a breach five years ago is, for a great many people, still their password — reused, never rotated, still valid on some service somewhere — and so it remains live inventory long after the breached company has paid its fines, sent its notification emails, and moved on. The market does not discard old credentials the way it discards old exploits, because passwords, unlike software versions, are not patched by the passage of time; they are changed only if the human being who owns them chooses to change them, and most do not. So the combolist accretes rather than expires: each new breach adds to it, and little falls out, and a pair from a decade-old breach sits in a current list beside a pair from last week, both replayed with equal hope, because both might still be true. The afterlife of the breach is the whole business model — the resale of credentials whose validity time does not erode, only human action does, and human action is rare.

And the loop closes, which is what makes RESOLD the structurally correct disposition rather than merely a description of the market. The access a stuffing campaign produces — the working accounts, the fraction of replays that hit — is itself a resold commodity: the valid accounts are sold on to buyers who want them for fraud, for further access, for their stored value or their identity, exactly as the register's access broker sold footholds. So the credential is resold as a list entry, replayed, and the account it unlocks is resold in turn. And the account, once compromised, often yields new credentials — a password reset reveals the email, the email reveals other accounts, each freshly breached account feeding the next combolist. The victim of one breach becomes a line in the next list; the resold credential produces a resold account which produces the next resold credential. It is a self-replenishing market in which nothing is ever quite used up, only copied, sold, replayed, and sold again — the afterlife of a breach extending, resale by resale, indefinitely into a future the original victim will never be told about.

5. Make Every Credential Single-Use

The register owes the defense, and here the defense is unusually clean, because a vector with exactly one prerequisite has exactly one root to cut: reuse. Everything the defender must do follows from the single principle that each credential should be single-use — valid in exactly one place — so that a pair breached from one service is worthless everywhere else, and the replay that is the whole of the attack finds nothing to unlock.

The primary measure, the one that defeats the vector at its root, is a unique password for every service, which for any realistic number of accounts means a password manager. A manager makes the humanly impossible — a different strong password for each of a hundred accounts — trivial, because the human no longer has to remember them; the manager does. And when every account has its own password, the breach of one unlocks exactly one, because there is nothing shared to replay: the combolist's wager on reuse loses every time, because reuse no longer exists. This is the difference between one account with a hundred front doors and a hundred accounts each with its own, and it is entirely within the user's power to choose. The second measure, which defends even when the first fails, is multi-factor authentication: with MFA enabled, a breached, reused, correctly-replayed password is still not enough, because the attacker lacks the second factor, and the account holds even against a valid credential. MFA is the defense that assumes the password will eventually be breached and replayed — which, for any password old enough, it may well be — and makes that replay insufficient on its own. Unique passwords make the replay wrong; MFA makes even a right replay incomplete.

Around these two roots, the supporting measures harden the rest. Users and organizations should monitor breach-notification services (the have-i-been-pwned class) to learn when their credentials have entered a combolist, and rotate the exposed password promptly — turning the credential's long afterlife into a short one by the one action that actually ends it. Service operators, for their part, defend the other side of the replay: rate-limiting and anomaly detection to catch the statistical signature of stuffing — the same tiny credential set arriving from many unrelated IPs that the honeypot sees so plainly — and to throttle or block it before the low per-attempt success rate can accumulate hits across millions of attempts. The honeypot's own view is the operator's early-warning system in miniature: a concentration of identical pairs from a scattered host population is stuffing in progress, visible in the logs to anyone who looks for concentration rather than volume. But the deepest defense remains the user's, and it is simple to state: never reuse a password, and where it matters, add a second factor, so that every credential unlocks one thing and one thing only. Do that, and the combolist — that vast, resold, ever-accreting inventory of humanity's reused passwords — holds not a single key that fits your locks, because you gave every lock its own.

6. The counter-narrative, steelmanned

The strongest objection to this case is that credential stuffing is not really a distinct vector but a footnote to the brute-force case already in the register — it is just guessing with a better wordlist, the honeypot's admin:123456 and admin:admin are trivial default credentials that prove nothing about breaches, and treating it as its own case with its own disposition is redundant.

The argument runs like this. The honeypot, the objection notes, is an SSH login, and the credentials it receives — admin:123456, admin:admin — are exactly the weak defaults the register's very first case, the default-password case, already covered; they are not evidence of breached-credential replay at all, but of the same tired default-credential guessing seen everywhere. So the honeypot cannot actually show credential stuffing; it shows default-credential brute force, and the combolist story is imported from OSINT and bolted onto honeypot data that does not really demonstrate it. And conceptually, the objection continues, stuffing and brute force are the same mechanism — automated credential trials against a login — differing only in where the candidate credentials come from, which is a detail of sourcing, not a difference of kind. Giving stuffing its own case with a RESOLD disposition, when the default-password case (RANSOMED or MINED) and the brute-force case already exist, is slicing one phenomenon into three.

The register grants the honeypot's limitation squarely and shows why the vector still stands. It is true that this particular honeypot, an SSH endpoint, primarily receives default and weak-credential attempts, and that admin:123456 arriving here is not proof that those exact pairs came from a specific breach — the register will not overclaim what the sensor shows. What the honeypot does show, and shows unambiguously, is the statistical signature the case actually rests on: not the weakness of the credentials but the concentration of them — one tiny set replayed identically from a hundred and thirty-six unrelated hosts, five thousand times over. That concentration-from-a-scattered-population is the fingerprint of list-driven replay rather than independent guessing, and it is real in the data whether the list is a breach compilation or a default-credential list, because a shared default-credential list is itself a combolist in miniature, replayed by the same mechanism. The vector the case describes — replay of a shared credential list, monetized as a resold commodity — is visible in the honeypot's concentration, and the breach-scale version (Collection #1, RockYou2021, the stuffing toolchains) is the same mechanism at the scale where it does real damage, sourced honestly to the public record rather than claimed from the sensor. On the redundancy objection: the default-password case is about the credential being unchanged from the factory; the brute-force case is about guessing an unknown credential; this case is about replaying a known-real credential harvested elsewhere, and the difference is not sourcing trivia but the entire economics — the known-real pair defeats password strength, which guessing cannot, and creates a resold-commodity market in breached credentials, which defaults and guessing do not. The disposition RESOLD is the point: this is the only case where the credential itself is the traded good, sold and resold across breaches, and that market — the afterlife of a breach — is a distinct phenomenon worth its own case, honeypot limitations and all.

7. Disposition — RESOLD

Case 24 followed credential stuffing — the automated replay of breached username:password pairs against unrelated services, driven by the combolist, the aggregated commodity file of humanity's reused passwords. Unlike the brute force it resembles, stuffing does not guess: it replays a known-real credential harvested from some other breach, on the wager — usually sound — that the victim reused it, which is why password strength does not defend against it and reuse is its entire prerequisite. The honeypot watches the replay in the concentration of what it receives: a small stable credential set (admin:123456, 5,385 times; admin:admin, from 136 unrelated IPs) arriving identically from a scattered host population — the fingerprint of one shared list replayed by many hands, not of independent guessing.

The disposition — the foothold's fate — is RESOLD, more literally than any other case, because the combolist is a commodity whose nature is to be sold again. Compiled from many breaches (Collection #1, ~773M records; RockYou2021, ~8.4B entries), packaged with per-target configs and stuffing tools (OpenBullet, Sentry MBA, SNIPR), it is sold and resold across forums and channels — the same list copied to many buyers, each breached pair outliving its breach because reuse and non-rotation keep it valid somewhere, for years. And the access the replay yields is itself resold, and each freshly breached account feeds the next list, so the victim of one breach becomes a line in the next: a self-replenishing market in which the credential is never used up, only copied, replayed, and sold again — the afterlife of a breach, extended resale by resale, indefinitely.

The defense cuts the single root the vector has: reuse. Make every credential single-use — a unique password per service, which for real numbers of accounts means a password manager — and a breached pair unlocks exactly one thing, so the replay finds nothing; add multi-factor authentication and even a correctly-replayed password is insufficient. Monitor breach-notification services and rotate exposed pairs to end their afterlife; operators rate-limit and watch for the concentration-from-scattered-hosts signature that is stuffing in progress. The vectors do not lie: the honeypot's login shows one list replayed five thousand times from a hundred and thirty-six hands, and behind it stands a market that bought that list, and sold it, and will sell it again — a breach whose afterlife outlasts the company that suffered it and the victim who never knew. We do not judge. We record. We let people judge — and then, if they are wise, give every lock its own key, so the resold list that holds the whole internet's passwords holds not one that fits their doors.

Follow the Access continues. Case 24 disposition: RESOLD. Confidence: HIGH — the replay signature is direct first-party honeypot capture (admin:123456 attempted 5,385 times; admin:admin from 136 distinct IPs; a small stable credential set concentrated across a scattered host population). The breach-scale combolist economy (Collection #1, RockYou2021, stuffing toolchains, forum/channel resale) is sourced to the public record, and the case states honestly that this SSH honeypot shows the list-replay mechanism and its concentration signature rather than proving any specific breach as the source of these exact pairs. The RESOLD disposition reflects the combolist's nature as a copied-and-resold commodity and the resale of the accounts the replay produces. The reuse dependency, the defeat of password-strength, and the unique-password/MFA defense are well-established. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the market that keeps every leaked password in stock, and the afterlife it sells, resale by resale, in the reader's name.