QLogs VIP 1070 MIX May 31, 2025: 50,584 US Credentials in an Early Series MIX Release

An Early Benchmark: QLogs VIP 1070 MIX Surfaces May 31 Data in a Jun 10 Release

The batch "QLogs VIP 1070 MIX 31-05-2025" is one of the earliest releases in the observed QLogs 2025 dataset, carrying 50,584 US credentails collected as far back as May 31, 2025 and distributed ten days later on June 10. The VIP label confirms that the operator's premium tiering system was already in use for MIX batches well before the June 20-23 cluster of non-VIP PCS releases -- establishing that VIP was a MIX designation first, extended to the PCS format only around June 26. The irregular file count of 1,070 -- similar to the later 1,143-file anomaly in the VIP PCS series -- suggests the operator's MIX batches have always had some tolerance for non-round file counts, unlike the more standardized PCS packaging.

QLogs VIP 1070 MIX (May-June 2025): Stealer Log Summary

• Records Exposed: 50,584
• Data Types: Email addresses, plaintext passwords, URLs
• Breach Type: Stealer log -- credentials harvested from malware-infected endpoints, not a direct database breach
• Password Type: Plaintext -- captured directly from browser sessions and credential stores by infostealer malware
• Country: United States
• Date Leaked: June 10, 2025

47.3 Rec/File: Above Average for MIX, Solidly Within VIP Range

At approximately 47.3 records per file, this batch exceeds the typical QLogs MIX yield of 24-41 rec/file while falling short of the ultra-high-yield MIX output seen in the June 12 VIP 2500 MIX batch at ~65.1 rec/file. The 47.3 figure places it comfortably in the VIP-eligible range for MIX batches, consistent with the operator's apparent criterion of applying the premium label when per-file output materially exceeds baseline. The irregulr 1,070 file count is consistent with the operator using MIX batches as a catch-all for residual or mixed endpoint pools -- assembled from whatever credentials remained after higher-priority packaging, resulting in non-round file counts that reflect actual available inventory rather than a standardized tier.

10-Day Staging: Textbook MIX Pipeline

The May 31 collection-to-June 10 release window is a 10-day staging period, falling precisely within the 9-13 day range observed for QLogs MIX batches throughout the 2025 dataset. This consistency -- from the 2,500-file VIP MIX at 12 days to this 1,070-file VIP MIX at 10 days -- confirms the MIX staging pipeline operates on a fixed schedule, likely involving automated deduplication, geographic tagging, and quality assessment before release. At this stage of the series, the infostealr pipeline had already achieved a level of operational regularity that would remain constant through at least the August-September batches observed later in the dataset.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to check whether your email or password has appeared in stealer log datasets, including early-series MIX releases like this one. The May 31 collection date means this data has been in threat actor hands since at least June 2025 -- well ahead of most breach notification timelines. Search your email at HEROIC's breach scanner and update any matched passwords immediately.