Hi, so Ive been seeing many posts about cracked wordpress logins (they work!). But the following question arose:

What do they use to crack them? Due to the nature of the combo (unique user and pass) I discarded the idea that they use bruteforce in order to get them. Which means, they use a combolist of sorts.

But the question that I have is what sort of combolist provides the website link with user and password? Like, what kind of database witholds such information? What service requires the user to input their wordpress credentials + link???