How LeakBase 1.7M ULP by blockchair Leaked 198,412 Logins

HEROIC found 198,412 records in LeakBase 1.7M ULP by blockchair on 25-Feb-2025, exposing email addresses, plaintext passwords, and HomePage URLs pulled from infostealer malware logs.

Why This LeakBase 1.7M ULP by blockchair Stealer Log Is Dangerous

A ULP, short for URL Login Password, is the most weaponizable file format in credential theft. Each line gives an attacker three pieces of information: the exact website the password belongs to, the email that signs in, and the password itself in clear text. No guessing, no rehashing, no sorting. The LeakBase 1.7M ULP by blockchair listing was posted to a major hacking forum as part of a 1.4 million record set, with 198,412 records pulled out as unique and clean enough to be sold as a standalone.

What makes a stealer log worse than a normal breach is the source. These credentials were not taken from a single company database. They were scraped off real users' computers by infostealer malware, which means the victim's entire browser vault was inside the original log. Anything saved to Chrome, Edge, or Firefox at the time of infection is considered exposed.

What Was Exposed in LeakBase 1.7M ULP by blockchair

• 198,412 unique records extracted from a 1.4 million row stealer log dump
• Email addresses used as the login for each compromised site
• Plaintext passwords captured directly from victim browsers
• HomePage URLs identifying the service each credential unlocks
• Dataset listed on a popular hacking forum with the name 1.7M, distributed by the handle blockchair

Why This Matters

The HomePage URL field is what separates this dump from a generic email and password combolist. Attackers can sort it by domain, extract every Gmail login, every PayPal login, every Coinbase login, and run them as targeted attacks. That process takes hours, not days, and it works on a high share of accounts whenever the password has not been rotated.

For any organization, this also means employees whose personal machines got infected are now bringing that risk into corporate systems. A stealer log captured at home on a Tuesday becomes a corporate breach on Wednesday because the same person uses the same password for their work SSO. That link is invisible to most detection tools.

How Stealer Log Dumps Like This Get Built

Infostealer families such as RedLine, Raccoon, Lumma, and StealC run on victim PCs after a fake installer, cracked software, or malicious ad delivers the payload. Within seconds the malware grabs every saved password, every cookie, and every autofill entry from the browser. The logs upload to a command server, get sorted, and eventually show up as packaged ULP drops on forums or Telegram.

The 198,412 count here is the deduplicated slice, which means the original pool was much larger. Dumps like this are the raw fuel for nearly every credential stuffing campaign that hits a consumer brand in 2025.

Check If You Are Affected

HEROIC watches over 400 billion compromised records, including stealer log drops like LeakBase 1.7M ULP by blockchair, the moment they surface. Because our graph connects emails, passwords, and source URLs, one scan can show you if your credentials appear in this dump or in any of the adjacent infostealer logs that feed credential stuffing attacks. Run a free HEROIC scan to see if you are in it.