ULP list

How it works

ULP stands for URL, login, password. Each line carries the address of the login page, the username or email, and the password. Group-IB describes the format as similar to a combolist but with the target website included, which makes it more immediately useful for credential stuffing.

Infostealer malware produces data in a similar shape, because it records login credentials together with the address of the site they belong to. The stealer logs Troy Hunt analyzed held website URLs with the email addresses and passwords entered into them.

How it shows up in executive exposure

Group-IB reports that ULP files are advertised and distributed through Telegram and dark web forums, alongside ordinary combolists. For an attacker, the URL removes guesswork. A line that names a corporate login page, a webmail portal or a bank is worth more than a bare email and password.

Executives who sign in to work accounts on personal devices are exposed through this route, because one infection can record every site they log in to. A line can also come from an old database leak or an earlier list, so a ULP entry alone does not show how the credential was stolen. EDG3 watches the Telegram channels and dark web forums where ULP files are advertised and distributed. WebThreat's CEM shows which executives appear in breach corpora and leak databases, so the first resets go to the most exposed leaders.

How to reduce the risk

• Use multi-factor authentication on every account that offers it, so a captured password is not enough.
• Use a unique password per site.
• Keep devices patched and avoid pirated software, which Troy Hunt names as one way people end up infected with stealer malware.
• Reset credentials when they appear in a list, starting with business-critical sites.

How it differs from related terms

A combolist holds only the identifier and the password. A ULP list adds the site. A stealer log is richer still, and can include device details and other captured data. Stealer logs are one of the sources ULP lists are compiled from, along with database leaks and older lists. See combolists vs stealer logs vs database dumps.