ULP stands for URLs, Logins, and Passwords. In cybercrime contexts, ULP data refers to structured credential dumps where each row ties a web address to a username and password. Much of this data originates from infostealer logs, password reuse across sites, and automated parsing of browser vault exports.
ULP feeds power credential stuffing, account takeover, and corporate SSO brute-force campaigns at industrial scale. Security teams that only monitor traditional breach disclosures often miss ULP exposure because it never appears on public breach notification lists. Continuous monitoring of stealer-derived ULP data closes that gap.
See how ULP volume is affecting SOC operations in our ULP burnout analysis and how attackers industrialize SSO attacks in our corporate SSO gateway report.