The UHQ Fresh FR Part1 Leak Holds 170,895 Stolen Login Records

HEROIC analysts identified a large combolist called UHQ Fresh FR Part1, uploaded by a Telegram user on 18 January 2023. Marketed as "FR" and "ultra-high-quality," the file contains 170,895 email addresses paired with plaintext passwords and the URLs of the login pages the credentials belong to.

Why This Is Dangerous

The UHQ Fresh FR Part1 leak holds more stolen login records than the population of a mid-sized city, all packaged as a single "Part1" file, which suggests additional parts exist or existed alongside it. The "UHQ" label means the credentials were checked and confirmed to work before being sold, making this a higher-quality and higher-risk batch than an average unverified dump of the same size.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the login pages tied to each account

Why This Matters

At 170,895 records, this file gives attackers a large pool of verified, working logins to attempt against email, banking, and shopping sites. Anyone whose password was reused across multiple accounts faces a much bigger blast radius than the original login alone, since one exposed password can unlock several unrelated services.

How Combolists Work

A combolist compiles email and password pairs gathered from stealer logs, older breaches, or phishing operations, then formats them into simple lines pairing each login with the site it opens. "UHQ" sellers run large batches like this one through automated checker tools to confirm which pairs still work, splitting the results into numbered parts for resale piece by piece across dark web marketplaces and Telegram channels.

Check If You Are Affected

HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including large verified combolists like this one. Run a free search now and change any password that comes back exposed.