Our Analysts Found the SunCloudNew 1779 Combo in a Telegram Channel

HEROIC analysts found a combolist labeled "SunCloudNew 1779 - 400 K ULP" circulating in a Telegram channel on 16 July 2026. The file contains 288,908 records made up of email addresses, plaintext passwords, and the login URLs those credentials belong to.

Why This Is Dangerous

ULP stands for "URL, login, password," and that is exactly what this file delivers for nearly 289,000 accounts. Each line hands an attacker a website, a username, and a working plaintext password, with no cracking or guesswork required to put it to use.

What Was Exposed

• Email addresses
• Plaintext passwords
• Login URLs for the associated accounts

Why This Matters

With nearly 289,000 records in one file, this combolist gives attackers a large pool of accounts to target through credential stuffing, automatically testing each email and password pair against banking sites, email providers, and social media platforms. Anyone who reuses passwords across multiple sites faces a real risk of account takeover if their details are included here.

How Combolists Work

Combolists like this one are usually assembled by pulling credentials from older leaks and stealer logs and merging them into one organized file, sometimes labeled with a batch name or size, as with "SunCloudNew 1779." Once compiled, the file is uploaded to Telegram channels where other users can download it and run the credentials against target sites at scale, turning scattered old leaks into one usable attack tool.

Check If You Are Affected

To find out whether your email address or passwords appear in this combolist or any other leak, HEROIC's free breach scanner checks your information against a database of more than 400 billion leaked records in just a few seconds.