22K UHQ Combolist: 19,708 Logins Mean Someone’s in Your Accounts

In March 2023, HEROIC analysts identified a stealer log advertised as "22k UHQ Combolist Mixed Domains" circulating on a Telegram channel. HEROIC's analysis confirmed 19,708 verified records in the file, including email addresses, plaintext passwords, and the URLs each login was tied to. The "mixed domains" label means the credentials span many different email providers and websites rather than being tied to a single service.

Why This Is Dangerous

A mixed-domain combolist like this one is dangerous because it means someone out there could already be logging into your accounts without you knowing. Each of the 19,708 records pairs a specific email address with its plaintext password and the exact site it was used on, so an attacker does not need to guess which service to target. Because the "UHQ" label means these credentials have been checked and confirmed working, this file is essentially a ready-made list of accounts an attacker can log into right now.

What Was Exposed

This leak included the following data types:

• Email addresses across a wide range of domains
• Plaintext passwords, verified as working
• URLs linked to each set of credentials

Why This Matters

With almost 20,000 verified credentials spanning many different services, this combolist is built for large-scale credential stuffing, where attackers try each email and password pair across banking sites, email providers, and social media platforms. Because the domains are mixed rather than limited to one service, a person's exposure here could affect several of their accounts at once if they reuse passwords, turning a single stolen credential into multiple compromised accounts.

How Stealer Logs Work

A stealer log comes from information-stealing malware, malicious software that infects a device through cracked software, fake downloads, or phishing attachments, then quietly extracts saved browser passwords and active sessions. A "mixed domains" combolist like this one is typically built by combining many individual stealer logs, filtering out dead or duplicate entries, and verifying the rest, which is why sellers can advertise it as UHQ, or ultra high quality, and charge more for it than a raw, unverified log of the same size.

Check If You Are Affected

With 19,708 verified records spread across many different domains, there is a real chance one of your accounts is represented here. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including verified combolists like this one, so you can find out quickly and update any passwords before someone else logs in first.