The HotmailKeywordResultsamrb27 List: 130 Accounts, One Full Flight

HEROIC analysts flagged a small combolist uploaded to Telegram in July 2026, internally labeled "HotmailKeywordResultsamrb27." The file contained 130 records pairing email addresses with plaintext passwords and login URLs, likely pulled together by someone searching for Hotmail-related accounts specifically.

Why This Is Dangerous

A list of only 130 records might seem insignificant, but size has nothing to do with risk. Every entry includes a plaintext password sitting right next to the matching email address and a URL to log in with. That is everything an attacker needs to attempt an account takeover in seconds, no cracking or guessing required.

What Was Exposed

• Email addresses
• Plaintext passwords
• Associated login URLs

Why This Matters

Small lists like this one often get filtered by keyword before being sold or shared, meaning someone specifically wanted Hotmail-linked accounts. That kind of targeting suggests the data may be used for follow-on attacks like phishing emails sent from a familiar-looking address, credential stuffing against other services, or attempts to reset passwords on other accounts tied to that same email — all common paths to account takeover and identity theft.

How Combolists Work

Combolists are compiled collections of username or email and password pairs assembled from previous breaches, phishing hauls, or malware infections. They are often filtered by keyword, domain, or region before being repackaged and shared, which explains why this file appears to be a curated slice of Hotmail-related credentials rather than a full-scale company breach.

Check If You Are Affected

If you use a Hotmail or Outlook-linked email address, it is worth checking whether your credentials appear in this leak or others like it. HEROIC's free breach scanner checks your information against more than 400 billion exposed records. Run a scan and change any password you no longer trust.