There is no counter on Mifare Ultralight (the first version type)

7.5.11 Counter
The MF0ICU2 features a 16-bit one-way counter, located at the first two bytes of page 
29h. The default counter value is 0000h.

The first1
 valid WRITE or COMPATIBILITY WRITE to address 29h can be performed
with any value in the range between 0001h and FFFFh and corresponds to the initial
counter value. Every consecutive WRITE command, which represents the increment, can
contain values between 0001h and 000Fh. Upon such WRITE command and following
mandatory RF reset, the value written to the address 29h is added to the counter content.
After the initial write, only the lower nibble of the first data byte is used for the increment
value (0h-Fh) and the remaining part of the data is ignored. Once the counter value
reaches FFFFh and an increment is performed via a valid WRITE command, the
MF0ICU2 will reply a NAK. If the sum of counter value and increment is higher than
FFFFh, MF0ICU2 will reply a NAK and will not increment the counter.
An increment by zero (0000h) is always possible, but does not have any impact to the
counter value.
It is recommended to protect the access to the counter functionality by authentication.

8.7 Counter functionality
The MF0ULx1 features three independent 24-bit one-way counters. These counters are
located in a separate part of the NVM which is not directly addressable using READ,
FAST_READ, WRITE or COMPATIBILITY_WRITE commands. The actual value can
be retrieved by using the READ_CNT command, the counters can be incremented
with the INCR_CNT command. The INCR_CNT command features anti-tearing
support, thus no undefined values originating from interrupted programing cycles are
possible. Either the value is unchanged or the correct, incremented value is correctly
programmed into the counter. The occurrence of a tearing event can be checked using
the CHECK_TEARING_EVENT command.
In the initial state, the counter values are set to 000000h.
The counters can be incremented by an arbitrary value. The incremented value is
valid immediately and does not require a RF reset or re-activation. Once counter value
reaches FFFFFFh and an increment is performed via a valid INCR_CNT command, the
MF0ULx1 replies a NAK. If the sum of the addressed counter value and the increment
value in the INCR_CNT command is higher than FFFFFFh, the MF0ULx1 replies a NAK
and does not update the respective counter.
An increment by zero (000000h) is always possible, but does not have any impact on the
counter value.