The Good Emails.txt_Hotmail 164 Dump: 1,281 Stolen Logins Surface

In October 2025, HEROIC analysts tracked a combolist file called "Good Emails.txt_Hotmail 164" after it was uploaded to a Telegram channel that trades in stolen login credentials. The file contained 1,281 records, each pairing an email address with a plaintext password and the URL of the site the login belongs to.

Why This Is Dangerous

Because the passwords in this file are stored in plaintext, anyone who downloads it can read them instantly, no cracking or decryption required. Attackers load lists like this into automated tools and try each email and password pair against banking sites, email providers, and social media platforms, hoping the victim reused the same password somewhere else.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential pair to the account it unlocks

Why This Matters

If any of the 1,281 accounts in this file reused their password on another service, an attacker already has what they need to try to log in there too. This kind of password reuse is one of the most common ways personal email, banking, and shopping accounts get taken over.

How Combolists Work

A combolist is simply a compiled text file of "email:password" pairs, often pulled together from older breaches, phishing pages, or stealer logs and repackaged for resale or free distribution on Telegram. They are attractive to attackers because they require no technical skill to use: the file is uploaded straight into credential stuffing software that automatically tests each pair against hundreds of websites.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion leaked records, including combolists like this one. Run a free scan to see if your credentials have surfaced in this or any other exposure, and change any reused passwords right away.