An 18 April advertisement priced one credential list subscription six ways, from $60 for a week to $1,450 for a year (SC-O020). The post never states a daily rate. Dividing each price by its days, which is our calculation, gives about $8.57 a day for the week and $3.97 for the year.
That slope is typical. We collected 233 distinct plan texts of this kind, and this article asks why credential lists are sold as time-limited plans and what the ladder shows about the product. The adverts show the pattern; the reasons we give are our reading, not something sellers state. The main investigation covers what the streams contain.
What Does a Typical Ladder Look Like?
The 233 texts come from the Combolist and Botnet Log classes and the combolist keyword set. They are distinct texts, not sellers, and 220 of them list two or more tiers. Four tiers is the most frequent size, with 63 texts.
One text can list more than one ladder, for example one per product, so we count ladder segments. The commonest is seven days and thirty days (28 segments), followed by seven days, thirty days and lifetime (17) and a three, seven, ten and thirty day ladder (17).
Sellers wrap the ladder in claims. Of the 220 plans with two or more tiers, 81.8% say “private” and 64.1% say “fresh” or “daily”, while 31.8% say “valid”. A trial tier appears in 34.5% and a lifetime tier in 42.7%. All of these are the seller’s own words, and none was tested.
The Day Gets Cheaper the Longer You Commit
We found 174 ladder segments with three or more core tiers, in 167 of the 233 texts. In 144 of those 174 (83%) the computed daily cost falls at every step, and in 152 (87%) it never rises. The longest tier costs a median 0.40 of the shortest tier per day (middle half 0.29 to 0.53). The table shows the April ladder in full.
| Period | Price as written | Computed per day |
|---|---|---|
| 1 week | $60 | $8.57 |
| 2 weeks | $100 | $7.14 |
| 1 month | $180 | $6.00 |
| 3 months | $450 (420 beside it) | $5.00 |
| 6 months | $800 (720 beside it) | $4.44 |
| 1 year | $1,450 (1200 beside it) | $3.97 |
The ad does not explain the second figure beside the long tiers, so we use the first. The per-day column is an illustrative ratio inside one ladder, not a market price, and a bare “$” does not name a currency. Nothing here compares one seller’s ladder with another’s.
The lifetime tier shows the same logic at the far end: take the 99 ladder segments that list both a 30-day tier and a lifetime tier. Lifetime costs a median 4.3 times the 30-day price (middle half 3.1 to 6.7 times). A buyer who expects the feed to last that long prepays at a discount, and the seller is paid for the whole period up front. Whether “lifetime” means the buyer’s life or the channel’s is not stated.
Why Give Away a Trial?
A buyer cannot easily check a credential list before paying, which would explain why sellers offer a cheap look. The commonest trial prices as written are $10 (32 plans), $5 (9) and $7 (8). One locked free drop advertises a three-day trial at $7, a weekly plan at $20 and a monthly plan at $50 (SC-O027), and the free file is the sample.
Renewal is a smaller lever. Only 3.6% of the 220 multi-tier plans use renewal wording. One cloud charges $20 to renew a $25 week and $40 to renew a $50 month (SC-O023), 20% below the first purchase. Read together, the trial and this one renewal discount fit a funnel: sample cheaply, commit longer, stay.
Can an Asking Price Rank Exposure?
The within-plan ratios above compare tiers in the same advertisement. They do not establish that a bare “$” names the same denomination across different advertisements, or that the underlying products are comparable.
We therefore do not pool those amounts to test whether “private”, “valid”, “fresh” or “daily” claims command a premium. Those are advertising words; we did not test the delivered material.
To assess exposure, check the material you actually see against your own accounts and known exposures. An asking price does not supply that evidence.
What a Rolling Window Does and Does Not Show
The product advertised is access for a set period to recurring drops, not one dated file. The main investigation counts 175 priced Combolist-class asking posts for the bulk-combolist form. Of these, 97 state an access period and one a per-line price, from an extractor that is only 49 to 74% accurate. Money buys time; what actually arrives while the plan runs, and whether it is renewed, the adverts do not show.
So an advert of this kind does not date or size any exposure on its own. What can be checked is a file you actually see. Match it against your own domains and users, and record the date you saw it (or the breach date, if known). Reset or revoke on a verified match.
A trial tier adds a second caution. It is best read as a sampling device, so one free file says little about the full feed, in either direction.
Both points support continuous Dark Web Monitoring over a single check, and the credential stuffing guide covers the reset side.
Two sibling articles cover the other price questions. The buyer rate sheet analysis reads prices that run the other way, from poster to supplier. The piece on fresh, private and valid claims tests the wording that wraps these ladders.
Method and Scope
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
Scope: Telegram-dominated posts, 1 January to 27 October 2026. Plan counts are distinct texts, not sellers, and extraction is rule-based, so prices are advertised terms and not sales. Per-piece, lookup and bank prices fall outside the ladders; for bank listings, the Fraud investigation explains why a price and a claimed balance stay apart. See the full methodology and the Stolen accounts research hub.
