One Telegram Upload: The Xavier_Ulp Archive Exposed 158,398 Logins

HEROIC analysts identified a combolist named "Xavier_Ulp - 372000 Xavier_Group" that a Telegram user uploaded on August 6, 2026. The file contains 158,398 records pairing email addresses with plaintext passwords and associated URLs, primarily tied to United States accounts.

Why the Xavier_Ulp Archive Is Dangerous

Each of the 158,398 records in this combolist includes a working email address, its exact password in plain text, and the URL where that login was used. There is no decryption or password cracking needed. An attacker who gets a copy of this file can start testing logins against real accounts immediately, at scale.

What Was Exposed in the Xavier_Ulp Combolist

• Email addresses
• Plaintext passwords
• URLs linked to each account

Why This Matters

With 158,398 records in a single file, the odds that at least some of these people reused their password on other accounts, such as email, banking, or shopping, are high. Attackers rely on that overlap to run credential stuffing attacks, trying the same email and password combination across many sites until one works. That is how a single leaked password can turn into a drained bank account or a stolen identity.

How a Combolist of This Size Gets Built

A combolist pairs stolen usernames or emails with matching passwords, often gathered from malware infections, phishing pages, or older breaches and then merged into a single large file. The "Xavier_Ulp" and "Xavier_Group" naming suggests this file was compiled and branded by whoever collected it before being shared on Telegram, a common distribution point for lists of this size.

Check If You Are Affected

If you want to know whether your email address is part of this combolist or any other breach, HEROIC's free breach scanner checks your information against a database of more than 400 billion breached records, giving you a clear answer in seconds.