Search Your Email: Dragon_ULP 5 Leak Exposed 1.5M Accounts

HEROIC analysts identified a new combolist circulating on the dark web on 17-May-2026, uploaded to a private Telegram channel by a user operating under the handle Dragon_ULP 5. The file contained 1,554,698 individual records pairing email addresses with plaintext passwords, along with the URLs of the sites those credentials were originally used on.

Why the Dragon_ULP 5 Combolist Is Dangerous

Because the passwords in this file are stored in plaintext, anyone who downloads it can read your password exactly as you typed it, no cracking required. Paired with your email address and the URL of the site it was used on, an attacker has everything needed to log directly into that account, and into any other account where you reused the same password.

What Was Exposed in This Leak

• Email addresses
• Plaintext passwords
• URLs of the associated login pages

Why This Matters for the 1.5 Million People Affected

Combolists like this one are the raw material for credential stuffing attacks, where automated tools test each email and password pair against banking sites, email providers, and social media platforms. Because the URL is included here, attackers can skip the guesswork and target the exact service each credential belongs to, making account takeover, identity theft, and financial fraud far more likely for anyone whose information appears in the file.

How This Combolist Was Built

A combolist is a compiled file of combo entries, an email or username paired with a password, gathered from older breaches, malware infections, or previous leaks and repackaged for resale or free distribution. This one was assembled and shared by a Telegram user under the handle Dragon_ULP 5, a common way stolen credentials move through dark web communities, and it was labeled private, meaning it may have already circulated among other threat actors before this wider release.

Check If You Are Affected

If you have an account tied to any of the 1,554,698 email addresses in this leak, your login details may already be circulating on the dark web. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including combolists like this one, so you can find out immediately whether your credentials were exposed and take action before someone else uses them.