What Is a ULP Leak? BabaUlpNew Exposes 90,724 Passwords

HEROIC analysts spotted a ULP dump known as "BabaUlpNew" circulating on Telegram, dated October 2025. ULP stands for URL, Login, Password, and true to its name, the file contains 90,724 records, each combining a website address with a username or email and its matching plaintext password.

Why This Is Dangerous

A ULP list is essentially a spreadsheet of working keys to other people's accounts. Because every entry already includes the exact site the credential belongs too, an attacker does not have to do any extra research. They can simply load the file into automated login tools and start testing accounts within minutes of downloading it.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters

ULP lists are a favorite tool for credential stuffing because they arrive pre-organized and ready to use. When people reuse passwords, and most do, a single leaked credential can unlock several accounts at once. That is how a leak like this one leads directly to account takeover, financial fraud, and identity theft for the people caught up in it.

How ULP Breaches Work

ULP files typically come from infostealer malware or from combining several smaller data leaks into one master list. The malware infects a device, often through cracked software or a phishing link, and quietly gathers browser-saved logins along with the site each one unlocks. That raw data is then cleaned up and formatted into the classic URL, login, password structure before being shared or sold on Telegram, exactly the format seen in this BabaUlpNew leak.

Check If You Are Affected

Want to know if you are one of the 90,724 people in this ULP leak? HEROIC's free breach scanner checks your email against a database of over 400 billion exposed records in seconds, giving you a clear answer so you can lock down your accounts right away.