Account Takeover Just Got Easier: MrBestCloud ULP Drops 1.1M Logins

On November 21, 2024, a threat actor using the handle DURAGA posted a stealer log to LeakBase titled "3Kk Ulp" -- short for 3,000,000 URL-Login-Password records. Analysis confirmed 1,158,605 unique email addresses, each paired with a plaintext password and the specific website URL where that password was used. This is not a theoretical risk: these credentials are in active circulation on underground forums, and automated tools are already using them to test account access across the internet.

Why This Is Dangerous

Stealer logs in ULP format are among the most operationally dangerous credential leaks. Each row gives an attacker three pieces of information at once: who the target is (email), what their password is (plaintext), and exactly which site it unlocks (URL). There is no cracking step, no guesswork. Attackers can begin testing credentials within minutes of downloading the file.

What Was Exposed

• 1,158,605 unique email addresses -- active user accounts confirmed by stealer malware
• Plaintext passwords -- no hashing, no cracking required, immediately exploitable
• Homepage URLs -- exact site identifiers showing where each password was captured

Why This Matters

Once a stealer log reaches a public forum, the consequences follow quickly:

• Credential stuffing: Bots automatically test each email-password pair against banking, email, streaming, and shopping services -- often within hours of posting.
• Account takeover: A compromised email account gives attackers access to password reset flows for every other service linked to that address.
• Identity theft: Email-password pairs with associated URLs confirm real account activity, giving attackers verified identity data they can use across multiple fraud schemes.
• Fraud: Accounts linked to payment methods or loyalty programs are drained or used for unauthorized purchases.

How Stealer Logs Work

Stealer logs are generated by information-stealing malware that infects devices through phishing emails, malicious downloads, or compromised software installers. Once installed, the malware silently extracts saved credentials from browsers, password managers, and session cookies. The output -- a file listing URLs, logins, and passwords -- is sent to the attacker's server, then compiled into large batches and sold or posted publicly. The "MrBestCloud" label in this dump's name refers to a cloud storage service the actor used for hosting the log.

Check If You Are Affected

If your device has ever been infected with malware, or if you have used the same password across multiple sites, your credentials could be in this dump. HEROIC's breach database covers 400 billion+ compromised records. Run a free scan now to find out if your email or password appears in this or any other known breach.

Search the HEROIC Database -- Free Scan