KURTXT ULP Quietly Leaked 2.28 Million Login Records Online

Not every leak announces itself with fanfare. The file known as "KURTXT_URL 1.7 MILLION ULP - 01-07-2025" slipped onto a Telegram channel in July 2025 without much notice, yet it contains 2,281,495 exposed login records. No press release, no big announcement, just a quiet upload that left millions of credentials sitting in plain text for anyone who happened to be watching that channel.

Why This Is Dangerous

Quiet leaks like this one are arguably more dangerous than the loud ones. Because there's no headline attached, most of the people whose data appears in it will never recieve a warning unless they actively check for themselves. The credentials sit there, unnoticed, while attackers quietly test them against banking sites, email providers, and social media accounts.

What Was Exposed

• Email addresses linked to real accounts
• Plaintext passwords with zero encryption
• URLs identifying the exact services affected
• 2,281,495 total login records exposed

Why This Matters

A leak this size, uploaded without warning, can sit around for months before anyone outside the Telegram channel notices it occured at all. That gives attackers a long head start, plenty of time to work through the list before affected users think to change a single password. Quiet doesn't mean small, and in this case it definitely doesn't mean safe.

How Stealer Logs Work

ULP stands for "username, login, password," and files labeled this way are typically compiled from stealer malware that infects a device and scrapes stored credentials straight from the browser. Logs from many seperate infections often get combined into one large ULP file like this one before being shared, which explains how a single upload can contain well over two million records at once.

Check If You Are Affected

Since this leak never made headlines, checking manually isn't really an option, most people would have no way of knowing. HEROIC's free scanner searches over 400 billion breached records, including quiet uploads like this one, so you can find out in seconds whether your email and password showed up here.