The ULP Good by Moon Dump Just Put 1,083,918 Logins Online

HEROIC analysts identified a large combolist labeled "ULP Good by Moon," internally filed as SUPP1_000002, that traces back to May 3, 2025, and was later uploaded to a Telegram channel. The file contains 1,083,918 records of email addresses, plaintext passwords, and the URLs each login was used on. Why this is dangerous: "ULP" stands for URL, login, and password, exactly what this file contains for over one million records. At this scale, and with plaintext passwords already paired to specific sites, an attacker has everything needed to run mass credential stuffing attempts with almost no extra work. What was exposed in the "ULP Good by Moon" combolist: email addresses, plaintext passwords, and URLs identifying the exact site each login belongs to. Why this matters: with over one million records, this is one of the larger combolists analysts have tracked recently. A leak this size gives attackers enough volume to automate account takeover attempts across banking, email, retail, and social media sites simultaneously. Because passwords are stored in plaintext, reused credentials are especially vulnerable, and any successful login can be used for financial fraud or identity theft. How a combolist like this one comes together: "ULP" combolists like this one are built by combining stolen credentials from many different sources, past breaches, phishing kits, and malware logs, then organizing them by URL so buyers know exactly which site each login unlocks. The label "Good by Moon" points to a specific seller or curator on Telegram who assembled and vouched for this batch, a common practice in underground marketplaces where "good" lists command a higher price than unverified ones. Check if you are affected: given the scale of this leak, it's worth checking your exposure directly. HEROIC's free breach scanner searches more than 400 billion leaked records to show whether your email and password appear in this leak or any other, so you can secure your accounts before they're used against you.