The Mikel Base UHQ Combolist: 2,158,687 US Records Exposed

The "Mikel Base UHQ" Combolist: 2,158,687 Records, Not 2.7 Million

HEROIC analysts identified a combolist file labeled "2.7KK USA HEAVY MIKEL BASE UHQ," uploaded to a Telegram channel and dated December 10, 2022. Despite the "2.7KK" (meaning roughly 2.7 million) in its name, HEROIC's analysis confirms the file actually contains 2,158,687 records, each pairing an email address with a plaintext password and a matching URL. The "UHQ" label, short for "ultra high quality," is dark web shorthand sellers use to market combolists as containing fresher, more reliable credentials.

Why This Is Dangerous

With more than two million email and plaintext password pairs in a single file, an attacker has enormous scale to work with, and no cracking is required since the passwords are not hashed. The paired URLs point directly to each account's login page, and the "UHQ" branding signals the seller claims these credentials are more likely to still be active than a random older dump.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to the accounts

Why This Matters

A file of this size sits near the top of the underground credential market precisely because of its volume and marketed quality. Criminals load lists like this into automated tools to run credential-stuffing attacks against banking sites, email providers, and online retailers, testing whether people reused their password elsewhere. At over two million records, even a small success rate translates into a large number of account takeovers, financial fraud cases, and identity theft incidents.

How "UHQ" Combolists Are Marketed in the Underground Economy

A combolist is a plain-text file of "combo" entries, an email or username paired with a password. Within the dark web credential trade, sellers grade and label their lists much like any other product line, tagging some as "fresh," others as "UHQ" or "heavy," to signal size and quality to buyers. These files are usually assembled from older breach data, phishing hauls, or malware infections, then packaged and marketed on Telegram channels and dark web forums under names designed to sound more valuable than the underlying data actually is.

Check If You Are Affected

Given the scale of this combolist, checking your exposure is worth the couple of minutes it takes. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including large combolists like this 2,158,687-record file, so you can find out if your email and password combination is circulating and update your credentials before someone else does.