Inside HOTMAIL TEST 2: How This Combolist Exposed 1,892 Logins

HEROIC analysts identified a combolist labeled HOTMAIL TEST 2 that was uploaded by a Telegram user on May 20, 2026. The file contains 1,892 records combining email addresses, plaintext passwords, and the URLs those credentials belong to. Why This Combolist Is Dangerous The passwords in this file were saved in plaintext, so there is nothing standing between an attacker and a usable login. With the account URLs bundled alongside each credential pair, anyone who gets hold of this file can start testing logins right away without needing to guess where each one belongs. What Was Exposed Email addresses Plaintext passwords URLs linked to the accounts Why This Matters Even a modest leak of 1,892 records can cause outsized damage because criminals automate the follow-through. If anyone in this file reused their email and password on other sites, banking apps, or social media, those accounts are now vulnerable to takeover. Attackers do not need to target you specifically; they simply run every credential in the file against popular login pages and see what works. How a Combolist Like This Gets Built A combolist is a compiled file of username or email and password pairs pulled together from past breaches, phishing pages, and malware infections that steal saved browser credentials. Test or trial uploads like this one, labeled with names such as HOTMAIL TEST 2, are often smaller batches that Telegram-based sellers post to prove a larger list is legitimate before selling the full version. Even these smaller test files contain real, working credentials that can be used immediately. Check If You Are Affected If you want to know whether your email address appears in this combolist or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion compromised records. Checking takes only a moment, and if you find a match, change that password on every site where you have reused it.