A ULP list is a plain-text file of stolen credentials in the format URL:Login:Password. Each line records the address of the site where the account is used, followed by the username or email and the password. The format is common in criminal channels because it can be fed directly into automated login tools.

How it works

• Most entries come from stealer logs, where infostealer malware records the site, user and password saved in a browser.
• Traders extract these lines from many logs, merge them, remove duplicates and sort them by domain.
• Because the URL is included, a buyer can filter for one company’s VPN, webmail or cloud portal.
• Unlike a classic combolist, which only pairs emails and passwords, a ULP line shows where the credential works.

Why it matters for dark web monitoring

MITRE ATT&CK describes how attackers gather credentials from sources such as breach dumps and then reuse them against target accounts. ULP lists make that targeting easy, which raises the risk of credential stuffing and account takeover. Since the lists are reshared many times, the same old record can appear again and again. Monitoring for credentials in combo and ULP lists helps teams find accounts tied to their own domains, check whether the password is still valid and force a reset.

Sources: MITRE ATT&CK T1589.001: Gather Victim Identity Information, Credentials, MITRE ATT&CK T1110.004: Credential Stuffing