Fresh, Private, Valid: How Combolist Claims Differ in Reposted Text

Combolist claims of “fresh”, “private” and “valid” appear about twice as often in reposted text as in text we did not see twice. Among 57 distinct reposted Combolist texts (131 posts), 49% say fresh, 30% private and 32% valid. Among 2,661 posts whose text we did not see twice, the shares are 26%, 15% and 14%.

The gap is real in this sample, but it describes how adverts are copied. It does not show what a file contains, when it was captured or who else holds it. The evidence is Brandefense’s Blackhole collection of Telegram-dominated posts from 1 January to 27 October 2026; counts are collected posts, not offers, sellers or victims.

Reposted Texts Claim More, on Every Word

We normalised each kept post by removing links, handles and digits, then grouped identical texts of 25 characters or more. Chatter, channel promotion, file pointers and lookup bots are excluded. A text seen at least twice in our sample is “repeated”.

Our sample is a small part of most collection windows: a median of about 4% of posts for the Combolist class and 2% for Botnet Log. A text we saw once may have been posted many times, so we call those “not seen twice”.

Copies of one text are not independent evidence. The 131 repeated posts are 57 distinct texts: 42 pairs, 13 triples and 2 groups of four, spread over 61 channels. Every copy within a group carries the same claim words, so the table counts each distinct text once.

The chapter’s weighted post-level shares, which count all 131 posts, read 52%, 38% and 34% against 28%, 15% and 14%. We use the unweighted distinct-text basis here because it does not count a copy twice.

Two other sets do not follow the pattern. In Botnet Log (37 repeated texts, 80 posts, against 1,533) fresh is 24% against 14%, private 14% against 15% and valid 8% against 5%. In the combolist keyword set (49 repeated texts, 118 posts, against 1,180) the shares are 31% against 32%, 29% against 30% and 27% against 24%. The result belongs to the Combolist class label alone.

Are Repeated Posts Just Better Advertisements?

The strongest alternative is that reposted text is simply more commercial and so uses more marketing words. We tested it three ways.

First, the mix: sale modes (priced, subscription or sale without a price) make up 58.0% of repeated offers and 58.9% of the others. Repeated posts are more often free shares (27% against 15%) and less often buy-side requests (11% against 17%). They are not more often sales.

Second, length: the median repeated post has 129 characters and the median other post 137, so longer copy does not explain the gap.

Third, we compared within the same product form and commercial mode, and resampled whole texts to allow for copies. The difference stays positive: about 21 points on fresh (interval 7 to 34), 14 on private (2 to 27) and 14 on valid (2 to 27).

The support is thinner than that suggests. Only 12 of 42 form-and-mode groups contain both kinds of post, and only 5 of those hold ten or more repeated posts. Labels for form and mode come from a classifier with about 0.70 group-level precision.

Single groups agree where they are large. Among sales with no price shown (49 repeated posts from 20 texts, against 993), private appears in 40% of the repeated texts and 10% of the others.

Subscriptions are different. The five repeated texts do not claim “private” more often than the 205 others (40% against 63%), and “private” already sits in most of the posts not seen twice. In the Botnet Log, the stratified difference on “private” is negative: about 11 points lower, with an interval from 21 points lower to level.

Why Might “Private” Travel With Copied Text?

This paragraph is our interpretation, not a measurement. A seller who wants many readers reposts, and a seller who reposts has every reason to call the stock private, so the wording scales with the audience. Free shares, which are more common among repeated posts (27% against 15%), and teasers also fit the pattern. The 63% rate in subscription posts fits this reading: there “private” looks like the name of a product tier, not a count of holders.

The catalogue shows the pattern in single records. Record SC-O028 advertises a private cloud with 5 to 20 thousand “fresh” combos a day, “verified”. Record SC-O023 shows an 83-line teaser called fresh and exclusive, then sells the whole cloud by access period, so “exclusive” need not mean one holder.

Record SC-O027 pairs a locked free drop with a private-cloud price list, in a pattern its entry says recurs under several names. How subscription tiers are priced is the subject of our credential prices companion.

Shared wording does not show common ownership: two channels may copy one template, or one operator may post twice, and our sample cannot tell which.

Repetition is also small among kept posts. Repeated text is 4.8% of kept Combolist posts, 4.3% of Botnet Log and 3.8% of the keyword set, all lower bounds. The largest Combolist group has four sampled posts.

Across bulk, file, cloud, free-drop and single-account posts in all four sets, 19 of 245 advertised size signatures appear in two or more channels. Fourteen of those span two or more months. A signature is a number plus a unit word such as “lines”; round numbers can coincide, so these are leads, not proof of reposting.

Why Raw Volume and Freshness Words Cannot Show New Exposure

A large share of raw repetition is removed before the kept sample. We estimate 1.05 million raw Botnet Log posts, of which 6.4% were kept and 26.3% were removed as template-bot near-duplicates, four times the kept share. Combolist had about 622,000 raw posts: 18.5% kept, 11.9% removed as template bots and 0.6% as exact duplicates.

Breach-lookup bots show the extreme. Repeated text covers 38.6% of their kept posts (interval 32.9 to 44.7), and 30.6% sit in clusters seen in two or more channels.

Record SC-O044 is an automated availability-output example. One selected line does not establish a daily frequency or a count of new victims. Because class labels changed between May and July, we draw no trend from raw or cleaned counts in either direction.

Freshness wording fails for a separate reason. “Fresh” is a seller’s word; we tested no file, and the flag detects words with a precision of about 0.5 to 0.9. A post saying “fresh” can describe an old file, and a post silent on it can describe a new one.

What a Defender Can Use Instead

Use the material, not the adjectives. Match your own domains and user names against the actual lists and logs, through dark web monitoring or files you can lawfully obtain. A match on one of your users is a fact about your estate, while a post that says “private” is not.

Let the match trigger the response, and match once per distinct file, not once per post. If the same file is reposted under ten adverts, one match is one finding, so a queue that counts reposts inflates itself.

Then check whether the matched material includes session data. If it does, revoke active sessions as well as resetting the password, because stolen cookies can bypass MFA. NIST SP 800-63B-4 expects a verifier to force a password change when there is evidence of compromise, and a match is that evidence; a claim word is not.

Our guides to credential stuffing and the account takeover lifecycle cover what follows a match, and the main investigation covers what these products offer.

Method and Scope

The repeat key is normalised text of at least 25 characters without links, handles or digits. The comparison covers kept Combolist offer posts drawn from 3,776 kept sampled posts, and claim flags are word matches with precision about 0.5 to 0.9. Channel identifiers were used only to count clusters.

The distinct-text and within-group comparisons are our own read-only checks over the same posts, and the scripts and output are saved with the manuscript. No file was downloaded or tested, and nothing here shows that a claim was true.

Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.

Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.

Brandefense analysts reviewed and approved the findings.

Method details: methodology. Hub: Stolen accounts research hub.