Dark Web Watch: Xavier_Ulp Leak Exposes 291,819 Logins

HEROIC's threat intelligence team, monitoring Telegram channels and dark web marketplaces, identified a combolist titled "Xavier_Ulp - 374993 Xavier_Group" dated August 5, 2026. The file contains 291,819 records pairing email addresses with plaintext passwords and the URLs those logins belong to.

Why the Xavier_Ulp Leak Is Dangerous

Combolists like this one move quickly once posted on Telegram and dark web forums, often getting copied and redistributed within hours. Because every password is stored in plaintext, anyone with the file can immediately try each pair against other websites, with no cracking required.

What Was Exposed in the Xavier_Ulp Combolist

• Email addresses
• Plaintext passwords
• URLs of the websites or services the credentials belong to

Why This Combolist Matters

With nearly 292,000 credential pairs, this file is large enough to fuel serious credential-stuffing operations. Anyone included faces a real risk of account takeover on any site where they reused their password, which attackers can escalate into further fraud or identity theft by using compromised email accounts to reset other passwords.

How a Combolist Like This Works

A combolist combines email or username and password pairs, gathered from older breaches, stealer logs, or previous credential-stuffing runs, into a single large file. The naming convention here, referencing a "Xavier_Group" and a specific record count, is typical of how sellers brand and market their combolists to buyers browsing Telegram and dark web forums.

Check If You Are Affected

HEROIC's free breach scanner checks your email address against more than 400 billion leaked records pulled from Telegram and the dark web, including combolists like Xavier_Ulp. If you find a match, change that password immediately and enable multi-factor authentication.