HEROIC Analysts Discover Universe_ULP Leak of 105,663 Login Lines

HEROIC's dark web research team recently flagged a dump going by the name "Universe_ULP 296000 ULP Line," posted to Telegram by an anonymous uploader. After validating the file, analysts confirmed 105,663 exposed records containing email addresses, plaintext passwords, and the web addresses those logins belong to. ULP, short for "URL, Login, Password," is one of the most common formats criminals trade because it is ready to use right out of the box.

Why This Is Dangerous

What makes this particular find concerning is the sheer usability of the data. Nothing is encrypted, hashed, or masked, every password sits in plaintext next to its matching email and site. A criminal doesn't need any special tools to make use of it, just a spreadsheet and a bit of free time. That lowers the bar for who can cause damage with this file, from experienced fraud rings down to amateur scammers.

What Was Exposed

• 105,663 total records confirmed exposed
• Email Addresses
• Plaintext Passwords
• URLs linked to each login pair

Why This Matters

A leak of this size doesn't stay in one seperate corner of the internet for long, it tends to get copied, repackaged, and resold across multiple channels within days. For the people whose credentials are in this file, the risk isn't limited to one account, since password reuse means a single leaked login can definately unlock email, banking, or shopping accounts that share the same password.

How Stealer Logs Work

This kind of dataset is built by malware quietly running in the background of an infected computer, scooping up whatever usernames and passwords are saved in the browser or typed during a session. The infected machine sends that stolen information home to whoever controls the malware, who then bundles it into a "log" and lists it for sale or gives it away to build a reputation on Telegram.

Check If You Are Affected

Do not wait to find out the hard way. HEROIC runs a free breach scanner built on more than 400 billion leaked records pulled from breaches, dumps, and stealer logs across the dark web. Enter your email and see instantly if you show up in this leak or any other one HEROIC has catalogued.