LeakBase 10.5Kk ULP by firegoon

We noticed a new stealer log surfacing on a prominent underground forum on May 21, 2024, with the rather uninspired title "10,5Kk Url;Log:pass." What struck us immediately was the sheer volume of credentials and associated metadata within the archive, suggesting a broad sweep of compromised systems. The log contained an estimated 10.5 million records, a significant figure even in today's landscape of frequent data exposures. While the source structure points towards a common credential-stealing malware, the sheer number of unique email addresses and the inclusion of homepage URLs warrant closer examination for potential targeting patterns. This event underscores the persistent challenge of credential compromise and the critical need for robust defenses against malware designed for widespread data exfiltration.

The breach, identified as originating from a stealer log titled "10,5Kk Url;Log:pass" and posted on May 21, 2024, represents a significant exposure of user credentials. This particular incident involved approximately 10.5 million records, with a notable 1,273,649 unique email addresses identified. The leaked data types are particularly concerning: email addresses, homepage URLs, and crucially, plaintext passwords. The source structure indicates a typical stealer log, likely exfiltrated by malware from infected endpoints. The implications are manifold, ranging from direct account takeovers via credential stuffing to spear-phishing campaigns leveraging verified email addresses and potentially even identifying the scope of a compromised organization's user base through the homepage URLs. The absence of any encryption for the passwords is a critical vulnerability that amplifies the risk to affected individuals and any systems they access with these credentials.

While this specific stealer log, "10,5Kk Url;Log:pass," has not yet garnered widespread media attention, its characteristics align with a persistent threat landscape. Similar incidents involving large-scale credential dumps are regularly reported by cybersecurity research firms and are a constant topic of discussion within OSINT communities. For instance, reports from organizations like Have I Been Pwned frequently catalog such breaches, highlighting the recurring nature of these exposures. The methodology employed – credential theft via malware – is a well-documented attack vector. The inclusion of homepage URLs, while seemingly minor, can be a valuable piece of OSINT for threat actors seeking to understand the network or service affiliations of compromised individuals, potentially enabling more sophisticated follow-on attacks.