# Comb

> Search the COMB (Combination of Many Breaches) dump — 3.2 billion email/username:password lines — via ProxyNova's free API (no key). Trigger whenever COMB, Collection of Many Breaches, ProxyNova comb, a combo list, or leaked email:password pairs from that 2021 compilation appear in the task, even if ProxyNova is not named. Use for plaintext email, username, or password lookup in COMB only. Hashes go to weakpass. Breach sources and live indexes go to leakcheck.

- Skill: `ibnaleem/comb` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add ibnaleem/comb`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ibnaleem/comb/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs, AI & ML
- License: GPL-3.0
- Author: ibnaleem (https://skillmd.com/u/ibnaleem)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ibnaleem/comb

---


# COMB

Query [ProxyNova COMB](https://www.proxynova.com/tools/comb/) — the February 2021 **Combination of Many Breaches** dump (~3.2 billion credentials). No API key.

Returns `identity:password` lines. This is **not** a live breach index and does not name source dumps. For "where did this email leak?" use `leakcheck`. For password **hashes** use `weakpass`.

Canonical caller: `skills/comb/scripts/lookup.sh`.

## Route

| Input | Action |
| --- | --- |
| Email, username, or plaintext password (min 4 chars) | COMB search |
| MD5 / NTLM / SHA-1 / SHA-256 hash | Stop. Use `weakpass`. |
| Need breach names, dates, or field categories | Stop. Use `leakcheck`. |
| Phone, domain, stealer origin | Stop. Use `leakcheck` (Pro for most of these). |

The API is a **token search**, not an exact match. `jrubin@aol.com` returns the same family of `jrubin@…` rows as `jrubin` (`count` may cap at **10000**). After the call, keep only lines whose identity equals the requested email (case-insensitive) when the user asked for that address.

## Lookup

```text
GET https://api.proxynova.com/comb?query={query}&start=0&limit=20
```

```bash
skills/comb/scripts/lookup.sh "$QUERY" [start] [limit]
```

URL-encode `{query}`. Minimum **4** characters.

| Param | Default | Rules |
| --- | --- | --- |
| `query` | required | Email, username, or password. Min 4 chars |
| `start` | `0` | Offset. Must be ≥ 0 |
| `limit` | `20` (API default) | Page size 0–100. `0` = count only, empty `lines` |

**`start + limit` must be ≤ 100.** `start=90&limit=10` is valid; `start=90&limit=15` is 400. You cannot page past the first 100 hits.

200:

```json
{
  "count": 795,
  "lines": [
    "jrubin@247callcapture.com:IUSPgL1T",
    "jrubin@247callcapture.com:michelle"
  ]
}
```

- `count` — total hits (not the page size). Generic tokens often show `10000` (Elasticsearch window cap), not a true total
- `lines` — this page, each `identity:password`. Identity is usually an email; case variants are separate rows
- Nothing found: `"count": 0`, `"lines": []` — still 200

`count` can be 795 while `lines` has 2 (`limit=2`). Always report both. Show a short sample; do not paste 100 passwords into chat.

## Errors

JSON body plus HTTP status. Surface both.

| Status | Body | Meaning |
| --- | --- | --- |
| 200 | `count` / `lines` | Hit or empty |
| 400 | `Search ?query must be at least FOUR characters long` | Query too short |
| 400 | `You are limited to 100 results` | `limit > 100` or `start + limit > 100` |
| 400 | `Something went wrong` + `exception_message` | Bad `start` (e.g. negative) |

Rate limit: about **100 requests/minute**. Space bulk checks. Do not retry 400. If a 429 appears, wait and retry once.

## Report

Quote API fields. Mark anything inferred. Filter to the requested identity when the query was an email.

```markdown
# COMB: {query}
- Dataset: Combination of Many Breaches (2021)
- Count: {n} (API total; may be capped at 10000)
- Returned: {len(lines)} (start={start}, limit={limit})
- Exact-email matches: {n}   (if filtered)

## Sample
- {identity} : {password}
```

Treat recovered passwords as sensitive. Put them in the report the user asked for; do not write them into logs, tickets, or world-readable files. Do not attempt logins with leaked credentials.

Docs: https://www.proxynova.com/tools/comb/