Dark Web Intel: Telegram alien ULP P695 Drops 5.75M Credentials

HEROIC discovered 5,755,002 records in Telegram alien ULP P695 by alien on January 20, 2025, leaking email addresses, homepage URLs, and plaintext passwords pulled from a 56 million line infostealer log distributed on Telegram.

Why This Telegram Credential Dump Is Dangerous

The @TXTLOG_ALIEN - 695.txt file is a ready-to-use attack kit. Every row pairs an email with a plaintext password and a target URL, which means anyone in the channel can launch automated credential stuffing the moment they pull the file off Telegram.

What Was Exposed in Telegram alien ULP P695 by alien

• 5.75 million unique email addresses pulled from 56M raw log lines
• Plaintext passwords ready for instant reuse across other services
• HomePage URLs showing the exact origin site for each credential

Why This Matters

Dark web intel teams treat stealer log drops like this as the earliest warning for downstream breaches. Business email compromise, SaaS tenant takeovers, and ransomware initial access almost always trace back to credentials that first surfaced in a Telegram leak weeks or months earlier.

How Telegram Stealer Channels Operate

Operators of channels like the alien ULP series run infostealer malware across thousands of infected endpoints, collect the exfiltrated credential files, and repackage them into sequential drops. Subscribers compete to weaponize the data first, testing the credentials against popular banking, crypto, and corporate SSO portals.

Check If You Are Affected

HEROIC scans more than 400 billion compromised records across the surface, deep, and dark web. Run your email through the HEROIC exposure scanner to see if your credentials surfaced in Telegram alien ULP P695 by alien, then rotate any reused passwords right away.