Dark Web Intel: Xavier_Ulp Dump Exposes 291,302 Login Pairs

Dark web intel update from the HEROIC team: a fresh combolist called Xavier_Ulp - 364900 Xavier_Group surfaced on Telegram on April 22, 2026, and it is not small. This one carries 291,302 records of email and password pairs, adding yet another sizable chunk to the ever growing pile of stolen credentials being passed around online.

Why This Is Dangerous

Intel like this matters because combolists of this size dont just sit around, they get pulled into automated attack tools almost imediately after release. Once a file this large hits a criminal channel, its usually only a matter of time before parts of it are being tested against major websites.

What Was Exposed

Our analysts confirmed the file contained:

• 291,302 total records
• Email Addresses
• Plaintext Password entries
• URLs showing which platforms the logins are tied to

Why This Matters

Fresh dark web intel on a leak this size gives defenders a head start, but only if people actually act on it. Every day that passes without checking your exposure is another day an attacker could be testing your old password against your current accounts, especially if youve reused it anywhere.

How ULP Combolists Work

Combolists like this one are built by aggregating stolen credentials, often sourced from stealer logs, into a single file of matching usernames and passwords. Once compiled, they circulate through dark web forums and Telegram groups, wich is exactly the kind of activity HEROIC's monitoring is designed to catch early.

Check If You Are Affected

Dont wait for more dark web intel to confirm what you could check right now. HEROIC's free breach scanner searches a database of over 400 billion leaked records and can tell you in seconds if your email shows up in this dump.