Our Analysts Found the LeakBase 1.9M ULP Dump Circulating With 52K Stolen Logins

On November 14, 2024, our analysts flagged a freshly posted stealer log on a prominent underground forum. The dataset, uploaded by a threat actor using the handle sirdr and listed under the name Ulp Fresh Logs, contained approximately 1.9 million credential records. After processing the dump, we confirmed 52,818 unique email addresses accompanied by plaintext passwords and the homepage URLs of the sites those credentials were stolen from. The label "fresh" in the dataset name is deliberate: it signals to buyers that these credentials have not yet been widely tested or burned, making them immediately actionable for account takeover.

Why This Is Dangerous

Stealer logs labeled as "fresh" command a premium on underground markets because the passwords they contain have not yet been rotated by victims who are unaware of the compromise. Every credential in this dataset was stolen directly off a victim's device, which means it reflects a real, current password rather than one that was hashed and cracked. The combination of email, password, and site URL hands attackers a complete login package with no additional effort required.

What Was Exposed

• Email addresses: 52,818 unique addresses confirmed from the full 1.9 million record dataset
• Plaintext passwords: Unencrypted and immediately usable
• HomePage URLs: The specific site each credential belongs to, enabling targeted attacks
• Total records: Approximately 1.9 million entries in the complete log

Why This Matters

Freshly stolen credentials fuel a predictable chain of exploitation:

• Credential stuffing: Automated bots test each email-password pair across banking, retail, and email platforms within hours of a dump going public.
• Account takeover: Working logins give attackers immediate access to accounts, enabling fund transfers, data theft, and fraudulent purchases.
• Identity theft: Email account access is the master key to every other account tied to that address via password reset flows.
• Phishing amplification: Confirmed active email addresses become high-value targets for follow-on social engineering campaigns.

How Stealer Logs Like This Are Built

Infostealer malware is delivered through phishing links, fake software cracks, and trojanized browser extensions. Once active on a victim's device, the malware extracts saved passwords from Chrome, Firefox, Edge, and other browsers, capturing credentials and the URLs they are associated with before any encryption touches the data. The collected files are bundled into logs and delivered to the operator, who then sells or releases them on forums like LeakBase. The Ulp Fresh Logs dataset follows this pattern exactly: a consolidated output from multiple endpoint infections, packaged and posted for mass consumption.

Check If You Are Affected

HEROIC monitors over 400 billion compromised records, including stealer log dumps like this one. Search your email address now to find out whether your credentials appear in this dataset or any of the thousands of other breaches we track.

Check your exposure free at HEROIC Identity Guard

What to Do If Your Data Was Exposed

• Change passwords immediately on the affected sites and anywhere you reused the same credentials.
• Enable multi-factor authentication on your email account first, then on all other critical services.
• Check for unrecognized devices or active sessions in your account security settings.
• Consider a password manager to ensure every account uses a unique, strong password going forward.