xss.is
Disclosed Sep 16, 2026
A massive credential combolist containing approximately 12-13 billion email:password pairs aggregated from multiple prior breaches and credential stuffing sources. Released as a 'special' on the Russian-language hacking forum XSS.IS by threat actors 'Xrenovi4' and 'Aldesa'. The data is a compilation/aggregation rather than a single source breach, containing credentials from a wide variety of global email providers (Gmail, Yahoo, Mail.ru, Rambler, Hotmail, etc.). The dataset spans 38GB in a single large text file.
Data found in this dataset
Search this dataset
Team members search this dataset here and through the API. Access is by invitation from your team admin, or by request.
Source files
Expand any file to inspect its column headers and the field each maps to.
12billion_special_for_xss.is__readme12billion.txt0 rows
File structure
Notes: free-form text with embedded emails / phones
12billion_special_for_xss.is__rez_out.txt2 columns3,039,417,306 rows
File structure
| Source column | Mapped field | Confidence |
|---|---|---|
| 0 | high | |
| combo identifier column — values parse as email addresses | ||
| 1 | password | high |
| combo secret column — value adjacent to the email identifier | ||
Notes: Heuristic auto-detection: credential combo list