If you have already downloaded and opened a suspicious combo list:

| Method | Quality | Legality | Cost | |--------|---------|----------|------| | HaveIBeenPwned API (anonymized hashes) | Low for direct use | Fully legal | Free | | SecLists repository (GitHub) – test combos only | Synthetic only | Legal | Free | | Commercial pentesting suites (Burp Suite Pro + BreachCompilation) | Medium | Legal with license | $400/yr | | Private bug bounty datasets (from HackerOne) | High | Legal (NDA required) | Expensive |

Never download a live combo list from a public source for testing real customer accounts. Use dummy accounts or internal test domains.

Professional security auditors and ethical penetration testers do not rely on generic downloads. They rely on customization.