Dark Web Find: 222x UhQ Hotmail Hits (bestseller580) Leaks 222 Logins

HEROIC analysts identified a stealer log file called 222x UhQ Hotmail hits test bestseller580, uploaded to Telegram in June 2024. The file contains 222 records, each combining an email address and a plaintext password with the URL of the login page it was captured from.

Why This Is Dangerous

Files like this are marketed on dark web channels as "hits," meaning working credential pairs verified by the seller before being sold or shared. Because the passwords are stored in plaintext and matched to specific login URLs, an attacker doesn't need to crack anything. They can simply try each credential directly against Hotmail and any other site tied to that same email and password.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each credential to its login page

Why This Matters

A compromised email account is often the gateway to everything else a person owns online, since it's typically used to reset passwords for banking, shopping, and social media. If any of the 222 victims reused their email password elsewhere, attackers can pivot from one account to many through credential stuffing, leading to account takeover, financial fraud, or identity theft.

How a Stealer Log Breach Like This Works

This file traces back to information-stealing malware, often bundled with pirated software or hidden in fake downloads. Once it infects a device, it silently collects saved browser logins and forwards them to the person running the malware, who then tests and packages the results as "hits" for resale. Listings like this circulate on Telegram and dark web marketplaces, often labeled by a seller or reseller username, in this case "bestseller580."

Check If You Are Affected

If you have a Hotmail account or reuse passwords across multiple sites, it's worth checking whether your credentials appear in leaks like this one. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including stealer log dumps like this, so you can find out quickly and change any exposed passwords.