The DRAGON_ULP 12 Leak Puts 3 Million Email and Password Pairs at Risk

In June 2026, HEROIC analysts recovered a combolist labeled PRIVATE ULP BY DRAGON_ULP 12 that a Telegram user uploaded. The file is enormous, containing 3,157,750 records, each pairing an email address with a plaintext password and the URL those credentials were tied to. It was uploaded on 03-Jun-2026 and is now indexed in HEROIC's dark web monitoring database.

Why This Is Dangerous

ULP stands for URL, Login, Password, the exact format this file uses to organize each record. That format is built for speed. An attacker can load millions of entries straight into automated tools and test them against login pages without any manual work at all.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs the credentials were associated with

Why This Matters

With more than 3 million records in a single file, even a small reuse rate translates into a large number of vulnerable accounts. If someone in this list used the same password for their email, banking, or social media, an attacker can walk right into every account tied to that password. At this scale, that risk plays out as account takeover, financial fraud, and identity theft for a large number of real people.

How This DRAGON_ULP Combolist Was Built

ULP combolists like this one are compiled by combining credentials from multiple breaches, stealer logs, and scraped data sources, then formatting them into the URL, Login, Password structure that makes bulk credential testing fast. Large, well organized combolists like this one are typically labeled private and traded or sold in closed Telegram groups before spreading more widely, which is where HEROIC analysts recovered this file.

Check If You Are Affected

With millions of records in play, don't assume you're not one of them. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, including this DRAGON_ULP 12 combolist, and tells you instantly if you've been exposed. Run a free scan now and change any passwords you may have reused.