Inside the 44K UHQ MIX Combolist: 44,239 High-Quality Stolen Logins

In May 2023, HEROIC analysts identified a combolist file called 44K UHQ MIX uploaded to a Telegram channel by an anonymous user. The file contained 44,239 records of email addresses, plaintext passwords, and the URLs of the accounts those logins belong to.

What "UHQ" Means and Why It Matters

UHQ stands for "ultra high quality" in underground marketplace slang, a label sellers use to signal that a combolist has been tested and cleaned rather than dumped raw. In practice, that means a higher share of the 44,239 credentials in this file are likely to still work, making the list more valuable and more dangerous than an unverified dump of the same size.

What Was Exposed in the 44K UHQ MIX Leak

• Email addresses
• Plaintext passwords
• URLs of the accounts and services those credentials belong to

Why a Higher-Quality Combolist Raises the Stakes

A combolist marketed as high quality attracts more buyers precisely because it wastes less of an attacker's time on dead logins. That means the working credentials inside are more likely to actually be tried against email, banking, and shopping sites through credential stuffing, turning a reused password into account takeover or identity theft faster than a lower-quality file would.

How a UHQ Combolist Gets Made

Sellers typically start with raw credential lists pulled from stealer logs, older breaches, or phishing campaigns, then run them through automated checkers that filter out logins that no longer work. What remains is repackaged and labeled UHQ, or "mix," to advertise that it has been cleaned and verified before being shared or sold on Telegram.

Check If You Are Affected

If your email could be part of the 44K UHQ MIX leak or any other breach, HEROIC's free breach scanner checks it against a database of more than 400 billion leaked records. Run a scan now and change any password you have reused across accounts.