The LeakBase 22Kk ULP Log Quietly Surfaced With 1.9M Passwords

HEROIC analysts identified a stealer log named "22Kk Url:log:pass" circulating on a well-known hacking forum around May 14, 2024, posted by a user going by "firegoon." The listing carried no fanfare or references, just a claim of roughly 22 million lines of stolen data, which narrowed down to 1,891,413 unique records once duplicates were removed. Each record paired an email address with a plaintext password and the homepage URL where that login was used.

Why the LeakBase 22Kk ULP Log Is Dangerous

Unlike a hacked database protected by hashing, this log contains plaintext passwords pulled directly from infected devices, meaning anyone who gets the file can log in immediately without cracking anything. The homepage URL attached to each record tells an attacker exactly which site or service the login unlocks, turning a quiet, unremarkable-looking post into a ready-made target list for account takeover.

What Was Exposed in the LeakBase 22Kk ULP Log

• Email addresses
• Plaintext passwords
• Homepage URLs tied to each login

Why This Matters for Anyone Reusing Passwords

With 1.9 million working email and password pairs in circulation, attackers can automate attempts against banking sites, email providers, and shopping accounts, a tactic known as credential stuffing. Because so many people reuse the same password across multiple accounts, one exposed login can quickly cascade into several compromised accounts, leading to account takeover, identity theft, and financial fraud.

How a Stealer Log Like This One Gets Built

Stealer logs like this one come from malware quietly installed on a victim's device, often disguised as a cracked program, pirated software, or a malicious attachment. Once active, the malware pulls saved browser passwords, autofill entries, and stored login sessions off the infected device, packages them into a file, and sends that file back to the attacker. That file is what eventually surfaces on hacking forums, exactly as happened with this 22Kk ULP log.

Check If You Are Affected

If you have reused a password across more than one account, it is worth checking whether your information is part of this leak. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, including logs like this one, so you can find out in about a minute whether you need to change your passwords.