Inside the Telegram Upload That Leaked 270,309 Xavier Logins

Somewhere in a Telegram channel on 13-Dec-2025, a user hit send on a file called Xavier_Ulp - 403700 Xavier_Group. Inside that single message sat 270,309 email and password combinations, ready for anyone in the channel to download for free. No headline news coverage, no press release, just a quiet upload that quite possibly compromised hundreds of thousands of accounts overnight.

Why This Is Dangerous

ULP dumps, short for URL, login, password, are combolists built for exactly one purpose: making it easy to try stolen credentials against a wide range of websites. Because the format lines everything up neatly, attackers don't even need much technical skill to use one, they just need a bit of automated software and a target list.

What Was Exposed

The 270,309 records in this dump contain:

• Email addresses
• Plaintext passwords
• URLs identifying wich services each login belongs to

Why This Matters

With a file this large, attackers often run what's called credential stuffing, automatically testing every single combination against popular login pages like email providers, banks, and social media. Out of 270,309 attempts, even a small success rate can hand over thousands of working accounts.

How Stealer Log Works

Combolists like this one usually start as separate stealer logs pulled from infected machines. Someone then takes multiple logs, strips out the useful email and password pairs, and organizes them into one clean ULP file. That consolidated list gets shared or sold because it's far more valuable and easier to use than a scattered collection of raw logs.

Check If You Are Affected

With a dump this size, checking your own exposure matters more than ever. HEROIC's free breach scanner searches across more than 400 billion leaked records, so you can see right away whether your email and password ended up in the Xavier_Ulp - 403700 file.