The LeakBase 1.3Kk ULP by blockchair Data Quietly Appeared on the Dark Web in October 2024
On October 13, 2024, a stealer log compilation titled "1.3Kk Url:log:pass" was posted to a prominent underground hacking forum by the threat actor known as blockchair. The dump contained approximately 1.3 million raw records. After deduplication, 162,048 unique email-password-URL triplets remained -- each one representing a real account on a real website, with a plaintext password attached, quietly available to anyone who found the post.
This release is part of a series of ULP compilations attributed to blockchair. Related dumps include LeakBase 3.6Kk ULP by blockchair, LeakBase 1.19Kk ULP by blockchair, LeakBase 6.6GB ULP by blockchair, and How LeakBase 1.7M ULP by blockchair Leaked 198,412 Logins.
Why This Is Dangerous
Unlike breaches where passwords are hashed and must be cracked, this dump delivers working credentials in plaintext. There is no technical barrier between the attacker and the victim's account. The homepage URLs included with each entry tell attackers which service the credential was stolen from, eliminating guesswork and enabling immediate, targeted login attempts. At 162,048 unique accounts, this represents a meaningful volume of directly exploitable access.
What Was Exposed
- Email addresses -- 162,048 unique accounts
- Plaintext passwords -- usable immediately without any decryption
- Homepage URLs -- site-specific targeting data paired to each credential
Why This Matters
- Credential stuffing: Automated tools begin testing these pairs against banking portals, email providers, and e-commerce sites the moment a dump is posted.
- Account takeover: A working email credential becomes a skeleton key -- attackers use it to trigger password resets on connected services.
- Identity theft: Email access combined with service context allows attackers to build a detailed profile of the victim's online life for further exploitation.
- Fraud: Accounts tied to payment methods or stored value (gift cards, loyalty points, subscriptions) are typically exploited first.
How Stealer Log ULP Files Are Created
ULP files originate from infostealer malware infections on individual computers. The malware extracts credentials saved in browsers, applications, and session tokens, recording the associated URL alongside each username and password. These raw logs are collected from thousands of compromised machines, aggregated, deduplicated, and formatted into the URL-Login-Password structure seen here. Actors like blockchair acquire or produce these logs and distribute them through underground forums -- building reputation and enabling a wide network of threat actors to act on the data simultaneously. The quiet, routine nature of these postings is exactly what makes them dangerous: they attract little mainstream attention while delivering immediately actionable intelligence to criminal operators.
Check If You Are Affected
Heroic's breach search engine indexes over 400 billion records from thousands of known data exposures, including stealer log compilations like this one from blockchair. Search your email address to find out whether your credentials appeared in this dump or any other known breach -- and get clear guidance on securing your accounts before someone else does.
Related Parts
Breach Breakdown
162,048 passwords exposed. Is yours one of them?
Enter your email to scan this breach plus 400B+ other leaked records. If you're compromised, we'll show you exactly where and what to change.
Free forever · No account required · Results in seconds
/img/qr-code.png)