You're likely either on a restricted network and/or something is intercepting the connections, or there is a problem with the network routing for your ISP, or the particular web server or web content caching server that is serving these files for your network has a configuration problem.
Schools and businesses can have these blocks, and some ISPs can also allow this, so please check with the network administrators — if it's not your own network connection.
The following DNS translation — the dig command shown is a command-line command issued from within a Terminal.app session — indicates that Ulta is using Akamai-based web caching, so what's wrong here can be very specific to the particular web caching server you're connecting with:
$ dig +short www.ulta.com
www.ulta.com.edgekey.net.
e6017.a.akamaiedge.net.
23.13.162.85
$
I've omitted the first few hops of the following path check, but the traceroute command shown — another Terminal.app command — will show you how far the network connection is getting to whatever host Ulta and Akamai are using for your area:
$ traceroute www.ulta.com
traceroute to e6017.a.akamaiedge.net (23.13.162.85), 64 hops max, 52 byte packets
1 {expurgated}
2 {expurgated}
3 {expurgated}
4 {expurgated}
5 xe-3-2-0.mpr4.bos2.us.above.net (208.184.223.233) 34.093 ms 34.295 ms 35.398 ms
6 ae2.mpr3.bos2.us.zip.zayo.com (64.125.25.41) 36.709 ms 39.058 ms 40.607 ms
7 ae7.cr1.lga5.us.zip.zayo.com (64.125.21.226) 44.658 ms 45.697 ms 45.851 ms
8 ae8.er1.lga5.us.zip.zayo.com (64.125.26.162) 43.138 ms 50.947 ms 44.567 ms
9 0.ae15.br2.nyc4.alter.net (204.255.169.1) 45.872 ms 46.701 ms
xe-0-1-0.gw14.nyc1.alter.net (204.148.1.149) 44.715 ms
10 0.ae0.xl4.iad8.alter.net (152.63.41.169) 46.515 ms 47.644 ms 48.675 ms
11 tengige0-6-0-0.gw1.iad8.alter.net (152.63.36.45) 58.987 ms
tengige0-4-0-0.gw1.iad8.alter.net (152.63.32.233) 49.418 ms
tengige0-4-1-0.gw1.iad8.alter.net (152.63.38.246) 52.171 ms
12 akamai.customer.alter.net (152.179.50.166) 48.320 ms 48.363 ms 44.673 ms
13 a23-13-162-85.deploy.static.akamaitechnologies.com (23.13.162.85) 45.798 ms 50.246 ms 48.967 ms
$
If your traceroute gets connected beyond your local network and your school or business or ISP's own network, then this error is likely not a firewall or policy block, but something at Ulta or at Akamai. Not much you can do about that, other than trying again later. If you get connected only as far as your own local network or blocked in your school or business or ISP network, then it's probably a local block, set by the organization and the network administrator.
In short, this probably isn't your Mac, and probably isn't something you can resolve from your Mac.