Goods_ULP US Telegram Leak Exposes 234 Login Credentials

What HEROIC Analysts Found in the "Goods_ULP" Leak

HEROIC's dark web monitoring team identified a file called "Goods_ULP" uploaded to Telegram and dated February 2, 2026. "ULP" is short for URL, login, and password, the exact format this combolist follows: it contains 234 records pairing email addresses with plaintext passwords and the URLs those accounts belong to.

Why This Leak Is Dangerous

Every record in this file already tells an attacker three things: the account's email, its plaintext password, and the exact site to use them on. That combination removes almost all the work a criminal would normally need to do, since there is no password cracking or guesswork involved.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs linked to each account

Why This Matters

Files in the ULP format are built specifically for credential stuffing, where attackers automate login attempts across many sites using the same email and password pair. If you reused the exposed password anywhere else, that other account is now at risk of takeover, which can escalate into identity theft or financial fraud depending on what the attacker gains access to.

How ULP Combolists Like This One Work

A URL, login, password, or ULP, file is a specific style of combolist built so automated tools can immediately test each credential against the listed site. This makes ULP files more directly usable by attackers than a plain list of emails and passwords, since the target site is already attached to every record. Files like "Goods_ULP" are traded on Telegram and elsewhere for exactly this reason.

Check If You Are Affected

A file this size can still expose your specific account, even if it is small compared to other leaks. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records to show you whether you are part of this leak or any other. Run a free scan and change any password that matches what turns up.