US-Based Users Hit as Redline Cl0ud4 ULP Leaks 409,525 Logins

Just two days after the first "FRESH VIP ULPP" file made the rounds, a second one appeared on 13-May-2026, this time labeled simply "FRESH ULPP 13-05-2026." HEROIC's monitoring team traced it back to the same Redline_Cl0ud4 source, and this batch carries 409,525 records, with the majority of the underlying accounts traced to the United States.

Why This Is Dangerous

Geography matters more than people realize when it comes to stolen credentials. Logs concentrated in one country, in this case the United States, are often repackaged and sold to buyers who specialize in targeting that region specifically, wich means the fraud that follows tends to be more convincing because the scammer already knows the victim's local bank, local retailers, and even local area codes.

What Was Exposed

• 409,525 total records
• Email Addresses
• Plaintext Passwords
• URLs of the affected accounts

Why This Matters

If you're based in the United States, this is one of those leaks worth taking personaly rather than skimming past. A password harvested off your laptop last month is just as usable to a criminal today as the day it was stolen, and plaintext means there's no encryption standing between the file and whoever opens it next.

How Stealer Logs Work

Stealer malware doesn't discriminate by target the way a hacker breaking into a single company does, instead it spreads through infected downloads, cracked software, and phishing links, then quietly reports back every saved password it finds on whatever machine it lands on. When enough infections cluster in one region, like the United States in this case, the resulting log naturally skews toward that country's users.

Check If You Are Affected

You can check your own exposure in under a minute. HEROIC's free breach scanner searches over 400 billion compromised records, including this Redline_Cl0ud4 log, so you'll know right away if your email shows up and what to do next.