HEROIC Analysts Discover Universe_ULP Leak of 187,105 Records

HEROIC's dark web monitoring team recently discovered a stealer log named Universe_ULP 351000 ULP Line circulating on a Telegram channel. Uploaded on November 6, 2025, the file contains 187,105 records made up of email addresses, plaintext passwords, and the URLs those credentials unlock. Our analysts moved quickly to document what was inside so affected users could be warned.

Why This Is Dangerous

The file name suggests it was pulled from a larger 351,000 line collection, wich means what got uploaded here may only be a portion of a much bigger operation. Even at 187,105 records, though, the danger is the same: plaintext passwords paired with exact login URLs give attackers everything they need with absolutely zero effort on their part.

What Was Exposed

• Email addresses used to log into affected accounts
• Plaintext passwords with no hashing or encryption
• URLs showing the specific services the logins belong to
• 187,105 total records identified in the file

Why This Matters

Discoveries like this one matter because most people never find out their credentials leaked untill it is far too late, often after an account has already been drained or hijacked. HEROIC's job is to close that gap by finding these files as soon as they surface and letting people check their exposure imediately instead of months down the line.

How Stealer Logs Work

Files like Universe_ULP are built by infostealer malware that infects a device, usually through a pirated download or a phishing link, and then quietly harvests every password saved in the browser along with cookies and autofill data. That harvested data gets organized into a log and shared or sold, often ending up exactly where HEROIC's analysts found this one, sitting in a Telegram channel open to anyone.

Check If You Are Affected

Rather than wait for a company to notify you, you can check right now. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including this one, so you can see in seconds if your email address turns up and act before anyone else does.