Our Analysts Found the LeakBase Logssupplier 1Kk ULP Dump Circulating on Underground Forums

HEROIC analysts identified a credential dump circulating on underground forums on November 25, 2024, titled "1kk fresh url:login:pass" and attributed to the actor LogLeader operating through LeakBase. The file contained roughly 1 million records in URL:login:password format. From that dataset, we extracted 460,076 unique email addresses, each paired with a plaintext password and the homepage URL of the originating site. The data was posted openly, meaning it required no purchase and no special access to obtain.

What made this discovery stand out was the freshness claim embedded in the filename. Actors who label dumps as "fresh" are signaling to other criminals that the credentials have not yet been widely distributed, tested, or burned through mass stuffing. That freshness window is exactly when credential stuffing attacks are most likely to succeed.

Why This Is Dangerous

Plaintext passwords in URL:login:password format are the most immediately weaponizable form of stolen credentials. Each record tells an attacker three things at once: which site the password works on, the login email, and the exact password. No cracking, no guessing, no preparation required. The attacker can begin testing immediately using automated tools against hundreds of platforms simultaneously.

What Was Exposed

• Email Addresses - 460,076 unique addresses verified as active accounts
• Plaintext Passwords - directly readable, no hashing or encryption applied
• Homepage URLs - identifying the specific site each credential pair originated from, enabling targeted attacks

Why This Matters

The ULP format is a preferred tool for several interconnected attack types:

• Credential Stuffing - Bots run the email and password combinations against banking portals, streaming services, email providers, and e-commerce sites. Password reuse across sites makes success rates consistently high.
• Account Takeover - A successful login typically leads to immediate account modifications, fund transfers, or use of stored payment methods.
• Identity Theft - Access to an email inbox allows password resets on every linked account, compounding the damage far beyond the original breach.
• Fraud - Compromised shopping or financial accounts are used to make unauthorized purchases, apply for credit, or redirect payments.

How Stealer Log ULP Dumps Are Created

ULP dumps originate from infostealer malware deployed through phishing campaigns, trojanized software, or malicious browser extensions. Once installed on a victim's device, the malware extracts saved passwords from browsers, reads autofill data, and captures active login sessions. The output is formatted into URL:login:password triplets and transmitted to the operator. Actors like LogLeader then aggregate logs from multiple sources, label them by freshness or volume, and distribute them on forums like LeakBase as a way to build reputation, attract buyers, or trade for other criminal services.

Check If You Are Affected

HEROIC monitors underground forums and indexes breach data continuously. With over 400 billion compromised records in our database, we can tell you whether your email appeared in the LeakBase logssupplier dump or any other known data exposure. Run a free search at heroic.com. If your address appears, change the associated password immediately and update any site where you used the same password.