Xavier_Ulp 361000 Leak Puts 164,114 Accounts at Risk of Takeover

On May 11, 2026, a Telegram user shared a massive combolist named Xavier_Ulp - 361000 Xavier_Group uploaded by a Telegram User, and this one wasn't small at all. It held 164,114 individual records, each one pairing an email address with a plaintext password and the web address it was used on.

Why This Is Dangerous

At over 164,000 records, this leak crosses into territory where automated attacks become really effective. Criminals don't need to manually test each login by hand, they run bots that try thousands of email and password combinations against banks, email providers, and shopping sites in minutes. Every plaintext password in this file makes that job easier.

What Was Exposed

• 164,114 total records
• Email Addresses
• Plaintext Password
• URLs connected to each login

Why This Matters

A leak this large usually means the credentials came from multiple sources, likely combined from several smaller stealer logs into one giant file, wich is exactly what these combolists are built for. That combination makes it far more useful to attackers than any single small log, because it gives them scale and a higher chance of finding reused passwords.

How Stealer Log Works

These combolists are usually assembled from smaller stealer log files that get merged together by whoever is collecting them. Malware infects individual devices, steals the saved credentials, and those separate logs eventually get combined into one large master list, like the 164,114 record file we're looking at here. The bigger the list, the more valuable it becomes to buyers on dark web forums.

Check If You Are Affected

Given the size of this leak, it's definately worth taking two minutes to check your own exposure. HEROIC offers a free breach scanner that searches over 400 billion compromised records, letting you see imediately whether your email has shown up in this leak or any other.