The Dark ULP Combolist Contains Exactly 159,493 Login Pairs

In August 2026, HEROIC analysts identified a combolist called Dark ulp, uploaded by a Telegram user, exposing exactly 159,493 records of email and username and password credentials, along with the URLs those accounts belong to. The name references the common ULP format, short for URL, login, and password, the standard structure used across this type of leaked data.

Why This Is Dangerous

The ULP format exists to make stolen credentials easy to use. Each line lists the exact website, the login, and the plaintext password together, so an attacker does not need to figure out where a stolen password belongs. It is already matched and ready to test.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs of the accounts tied to each login

Why This Matters

With nearly 160,000 records structured this way, this list is built for fast, automated credential stuffing across many sites at once. Anyone whose login appears here is at risk of account takeover, and if the password was reused elsewhere, that risk spreads into identity theft and financial fraud on unrelated accounts.

How Combolists Like Dark ulp Are Built

A ULP-format combolist is compiled from email or username and password pairs pulled from older breaches, stealer logs, and leaked databases, then formatted so each record lines up with its matching website. Sellers and Telegram distributors often clean and verify these lists before circulating them, since a well-organized ULP file is more valuable to buyers running automated login attempts.

Check If You Are Affected

This combolist is one of thousands feeding into HEROIC's database of more than 400 billion breached records. Use HEROIC's free dark web scanner to check whether your email address or passwords appear in this leak or any other exposure, and secure your accounts before someone else logs in first.