How This ‘UHQ Mix’ Combolist Leaked 4,004 Login Credentials

On 28 June 2026, a combolist titled "4013x UHQ Mix" appeared on Telegram. HEROIC verified the file contains 4,004 records of email addresses, plaintext passwords, and associated URLs. The "UHQ," or ultra-high quality, label is a marketing term sellers use to signal that the credentials have been checked and are believed to work.

Why This Is Dangerous

Credentials marketed as "UHQ" typically go through a validation process before being sold, meaning buyers can trust that a higher percentage of the 4,004 records will actually work. Paired with plaintext passwords, this combolist can be weaponized the moment someone acquires it.

What Was Exposed

The "4013x UHQ Mix" combolist contains:

• Email addresses
• Plaintext passwords
• Associated URLs

Why This Matters

Because this is a "mix" list pulling from multiple sources, the 4,004 accounts inside could belong to any number of services, from email providers to shopping sites. That breadth makes it a versatile tool for credential stuffing, and anyone who reused their password faces a real risk of account takeover and downstream identity theft.

How This Combolist Was Built

An "UHQ mix" combolist is typically assembled in stages: credentials are first gathered from breaches, phishing kits, or stealer malware, then run through automated checker tools that test each login and discard the ones that fail. What's left is repackaged and sold as premium "ultra-high quality" stock, which is exactly what likely happened with this 4,004-record file before it reached Telegram.

Check If You Are Affected

Since this combolist is marketed as verified and working, it's worth checking your exposure sooner rather than later. HEROIC's free breach scanner searches more than 400 billion leaked records, including this combolist, so you can find out in seconds.