How a Telegram Combolist Exposed Hotmail Roblox Logins

HEROIC analysts traced how a small combolist named hotmail 2 2_hits_no-replyroblox.com ended up circulating on Telegram, first appearing on 13-Dec-2024. It began the same way most of these lists do: a batch of stolen Hotmail credentials was tested against Roblox's notification system, and 6 pairs came back as confirmed, working hits.

Why This Is Dangerous

Because these 6 records were confirmed working before they were ever posted, whoever picks up this file does not need to guess or brute force anything. They can log straight into a real Hotmail inbox tied to a Roblox account using the plaintext password included in the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential to Roblox notifications

Why This Matters

Once a Hotmail account is compromised, an attacker can pivot into any other account tied to that inbox, including gaming accounts, password resets, and financial notifications. This is exactly how credential stuffing turns one small leak into account takeover, identity theft, and fraud across accounts the victim never expected to be at risk.

How Combolist Breaches Work

Combolist creators start with huge volumes of previously leaked email and password combinations, then run them through automated checkers against specific services, in this case Roblox's email system, to see which ones still log in. Only the confirmed hits, like these 6 records, are kept and repackaged for sale or free distribution on Telegram.

Check If You Are Affected

If your Hotmail address has ever been tied to a Roblox account, it is worth confirming whether it appears in a leak like this one. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, giving you a clear answer in seconds so you can secure your account before it is misused.