Inside the Credential Trade: 315,367 Xavier_Ulp Logins Leaked

There is an entire underground industry built around trading stolen logins, and Xavier_Ulp - 391240 Xavier_Group is a fresh addition to its inventory. Posted to Telegram on April 21, 2026, this combolist packs in 315,367 records of emails and plaintext passwords, feeding directly into a marketplace where stolen credentials are bought, sold, and traded like any other commodity.

Why This Is Dangerous

The credential trade operates a lot like a supply chain. Stealer logs and combolists like this one are the raw material, and criminal buyers further down the line use them for account takeover, fraud, and identity theft. The bigger and fresher the file, the more valuable it is to that ecosystem, wich makes a 315,367 record dump a genuinely attractive product for bad actors.

What Was Exposed

Analysts found the following inside the file:

• 315,367 total records
• Email Addresses
• Plaintext Password entries
• URLs identifying the associated login pages

Why This Matters

When credentials move through this kind of trade, they often get bought by multiple parties who each use them for different purposes, one for spam, another for financial fraud, another for identity theft. A single leaked password can end up recieving attention from several unrelated criminal operations before the person it belongs to ever finds out.

How ULP Combolists Work

Combolists are compiled by pulling matching email and password pairs from stealer logs or previous breaches and formatting them for easy automation. Once assembled, they get uploaded to Telegram channels or dark web forums that specialize in this exact kind of trade, where other criminals can download, test, and reuse the data as they see fit.

Check If You Are Affected

Its worth knowing if your data has entered this trade. HEROIC's free breach scanner checks a database of more than 400 billion leaked records so you can find out quickly whether your email and password have been caught up in a dump like this one.