How HEROIC Traced the 20.2M TXTLOG_ALIEN 89M ULP Credential Dump

HEROIC discovered 20,259,662 records in BreachForums TXTLOG_ALIEN 89M ULP by txtlog_alien on January 12, 2025, leaking email addresses, homepage URLs, and plaintext passwords pulled from a 90 million line aggregated stealer log posted to BreachForums.

Why This Stealer Log Dump Is Dangerous

The 89M ULP is a deduplicated combo list, which is the product mix-ready form of infostealer output. Everything in the file is tuned for direct credential stuffing, and each record doubles as a phishing lead because the homepage URL is already tied to the victim's account.

What Was Exposed in BreachForums TXTLOG_ALIEN 89M ULP by txtlog_alien

• 20.25 million unique email addresses drawn from 90M raw log lines
• Plaintext passwords harvested from compromised browser credential stores
• HomePage URLs pinpointing the target service for each login pair

Why This Matters

A single ULP combo list of this size can drive weeks of attacks across banking, SaaS, crypto, and work VPN logins. Every password reuse is a potential breach, which is why the discovery and triage of dumps like this is a core part of proactive dark web monitoring.

How HEROIC Finds Stealer Log Dumps

Our telemetry surfaced the 89M ULP post through continuous monitoring of BreachForums, Telegram mirrors, and dark web marketplaces. We pulled the listing, validated the records against known schemas, deduplicated the data, and indexed it into the HEROIC exposure graph so affected users can be alerted in near real time.

Check If You Are Affected

HEROIC scans more than 400 billion compromised records across the surface, deep, and dark web. Run your email through the HEROIC exposure scanner to see if your credentials surfaced in BreachForums TXTLOG_ALIEN 89M ULP by txtlog_alien, then rotate any matching passwords right away.