Dark Web Intel: 2.6 Million Credentials From the Indra ULP Dump

What HEROIC Analysts Found

In July 2026, HEROIC analysts identified a large combolist file uploaded to Telegram, labeled "Private ULP by indra." The file contained 2,656,328 records pairing email addresses with plaintext passwords, along with the URLs of the sites those logins belong to.

Why This Is Dangerous

ULP stands for URL, login, and password, meaning each line in this file is a complete, ready-to-use set: the website, the username or email, and the matching password, all in one place. With over 2.6 million of these sets in a single file, anyone who gets hold of it has a massive, plug-and-play list of accounts to try logging into.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linking each login to the site it belongs to

Why This Matters

A file of this size is built for automation. Criminals load ULP lists like this one into credential-stuffing tools that test each email and password pair against dozens of websites at once, banking, email, shopping, and social platforms included. Anyone who reuses passwords across multiple accounts is at heightened risk of having more than one account taken over if their credentials appear in this file.

How ULP Combolists Work

A ULP file is a specific style of combolist, structured so that each line lists a website URL, a username or email, and a password together. This format is popular because it plugs directly into automated login-checking software, letting an attacker test millions of credential pairs against real sites with almost no manual effort. Labeling this file "private" suggests it was intended for a smaller, invite-only group before it surfaced more widely on Telegram.

Check If You Are Affected

With more than 2.6 million records in this file alone, checking your own exposure matters. HEROIC's free breach scanner searches a database of over 400 billion leaked records to tell you if your email address has turned up in this leak or others, so you know which passwords to change first.