{
  "type": "URL",
  "indicator": "https://login.live.com/login.srf",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://login.live.com/login.srf",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "alexa",
        "message": "Alexa rank: #18",
        "name": "Listed on Alexa"
      },
      {
        "source": "akamai",
        "message": "Akamai rank: #42",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain live.com",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain live.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 4193553426,
      "indicator": "https://login.live.com/login.srf",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69228447b9c71795633314df",
          "name": "Keep Corrupt - University of Alberta Incidents continue to escalate - 04.24.26",
          "description": "Recovered accounts that have been used & abused - courtesy of decisions by non-technical leadership = accounts for UAlberta students -> PW manager made inaccessible (tied to UAlberta account) during a Data-Breach.\nWhen PW manager & Accounts returned, was populated by these (many = fraudulent; some appear to be abuse of legitimate services, while others do not, yet don't know function or origin)\n\nNot representative of OG PW manager. Many (most) accts. used/abused (on-going). \n\nDon't have a backup of original = hard to compare. Don't quite know what the majority of these companies etc. are for and/or do exactly. Putting them together as they roll-in.\nCan't turn them off in most cases - I don't have access to the U of A accounts these originate from and/or original recovery methods. \n\n2 more batches to add to this pulse (Need to add into VT) 02.16.26\n\nCountries listed are where 2 victims (UAlberta Graduates) have citizenship or some tie with.",
          "modified": "2026-05-24T21:18:51.782000",
          "created": "2025-11-23T03:49:27.649000",
          "tags": [
            "geoip",
            "as54113",
            "fastly",
            "as20940",
            "as15169",
            "google",
            "as214401",
            "maincubesas",
            "gmbh",
            "apache geoip",
            "facebook",
            "UAlberta",
            "AHS",
            "Treaty 8",
            "GoA",
            "Alberta",
            "Edmonton",
            "YEG"
          ],
          "references": [
            "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a",
            "URLscanio, FSio, vT",
            "03.11.14: https://www.virustotal.com/graph/embed/ge2e309eb8bd34fcca56398089b2291058dfe1fca69dc4e5aa66db0365caf735b?theme=dark",
            "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/summary",
            "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/iocs",
            "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a (11.22.25)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Cura\u00e7ao",
            "Guatemala",
            "Sint Maarten (Dutch part)",
            "Tanzania, United Republic of",
            "Barbados",
            "United States of America",
            "Bahamas",
            "Anguilla",
            "Canada",
            "Saint Vincent and the Grenadines",
            "United Kingdom of Great Britain and Northern Ireland",
            "Kenya",
            "France",
            "Aruba",
            "Mexico",
            "Poland",
            "Costa Rica",
            "Ireland",
            "Trinidad and Tobago",
            "Netherlands",
            "Slovakia",
            "Spain",
            "Philippines"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government",
            "Technology",
            "Telecommunications",
            "Education",
            "Healthcare",
            "Finance",
            "Retail",
            "Hospitality",
            "Transportation"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 3,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 47,
            "FileHash-MD5": 53,
            "FileHash-SHA1": 16,
            "FileHash-SHA256": 1059,
            "URL": 6374,
            "domain": 3314,
            "email": 1395,
            "hostname": 3740,
            "CVE": 1
          },
          "indicator_count": 15999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 136,
          "modified_text": "6 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bf4cc74c3d8f391a1a927c",
          "name": "9e42ac52bda44d5cadcabffd1d5e78a06598c8b5",
          "description": "",
          "modified": "2026-05-17T15:53:27.707000",
          "created": "2026-03-22T01:58:31.611000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 308,
            "FileHash-SHA1": 305,
            "FileHash-SHA256": 362,
            "URL": 369,
            "hostname": 376,
            "domain": 193,
            "email": 13
          },
          "indicator_count": 1926,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "13 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bf6652beb00c62a9cb8b84",
          "name": "i cloned msudosos - IOC breakdown = Possible ELF/Prometei Botnet CnC Activity",
          "description": "",
          "modified": "2026-04-21T02:20:25.690000",
          "created": "2026-03-22T03:47:30.942000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "69bf4cc74c3d8f391a1a927c",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 308,
            "FileHash-SHA1": 305,
            "FileHash-SHA256": 362,
            "URL": 367,
            "hostname": 372,
            "domain": 192,
            "email": 13
          },
          "indicator_count": 1919,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "40 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a (11.22.25)",
        "03.11.14: https://www.virustotal.com/graph/embed/ge2e309eb8bd34fcca56398089b2291058dfe1fca69dc4e5aa66db0365caf735b?theme=dark",
        "URLscanio, FSio, vT",
        "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/iocs",
        "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/summary",
        "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Government",
            "Finance",
            "Hospitality",
            "Transportation",
            "Healthcare",
            "Technology",
            "Telecommunications",
            "Education",
            "Retail"
          ],
          "unique_indicators": 9346
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/live.com",
    "whois": "http://whois.domaintools.com/live.com",
    "domain": "live.com",
    "hostname": "login.live.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69228447b9c71795633314df",
      "name": "Keep Corrupt - University of Alberta Incidents continue to escalate - 04.24.26",
      "description": "Recovered accounts that have been used & abused - courtesy of decisions by non-technical leadership = accounts for UAlberta students -> PW manager made inaccessible (tied to UAlberta account) during a Data-Breach.\nWhen PW manager & Accounts returned, was populated by these (many = fraudulent; some appear to be abuse of legitimate services, while others do not, yet don't know function or origin)\n\nNot representative of OG PW manager. Many (most) accts. used/abused (on-going). \n\nDon't have a backup of original = hard to compare. Don't quite know what the majority of these companies etc. are for and/or do exactly. Putting them together as they roll-in.\nCan't turn them off in most cases - I don't have access to the U of A accounts these originate from and/or original recovery methods. \n\n2 more batches to add to this pulse (Need to add into VT) 02.16.26\n\nCountries listed are where 2 victims (UAlberta Graduates) have citizenship or some tie with.",
      "modified": "2026-05-24T21:18:51.782000",
      "created": "2025-11-23T03:49:27.649000",
      "tags": [
        "geoip",
        "as54113",
        "fastly",
        "as20940",
        "as15169",
        "google",
        "as214401",
        "maincubesas",
        "gmbh",
        "apache geoip",
        "facebook",
        "UAlberta",
        "AHS",
        "Treaty 8",
        "GoA",
        "Alberta",
        "Edmonton",
        "YEG"
      ],
      "references": [
        "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a",
        "URLscanio, FSio, vT",
        "03.11.14: https://www.virustotal.com/graph/embed/ge2e309eb8bd34fcca56398089b2291058dfe1fca69dc4e5aa66db0365caf735b?theme=dark",
        "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/summary",
        "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/iocs",
        "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a (11.22.25)"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Cura\u00e7ao",
        "Guatemala",
        "Sint Maarten (Dutch part)",
        "Tanzania, United Republic of",
        "Barbados",
        "United States of America",
        "Bahamas",
        "Anguilla",
        "Canada",
        "Saint Vincent and the Grenadines",
        "United Kingdom of Great Britain and Northern Ireland",
        "Kenya",
        "France",
        "Aruba",
        "Mexico",
        "Poland",
        "Costa Rica",
        "Ireland",
        "Trinidad and Tobago",
        "Netherlands",
        "Slovakia",
        "Spain",
        "Philippines"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Government",
        "Technology",
        "Telecommunications",
        "Education",
        "Healthcare",
        "Finance",
        "Retail",
        "Hospitality",
        "Transportation"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 3,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 47,
        "FileHash-MD5": 53,
        "FileHash-SHA1": 16,
        "FileHash-SHA256": 1059,
        "URL": 6374,
        "domain": 3314,
        "email": 1395,
        "hostname": 3740,
        "CVE": 1
      },
      "indicator_count": 15999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 136,
      "modified_text": "6 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bf4cc74c3d8f391a1a927c",
      "name": "9e42ac52bda44d5cadcabffd1d5e78a06598c8b5",
      "description": "",
      "modified": "2026-05-17T15:53:27.707000",
      "created": "2026-03-22T01:58:31.611000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 308,
        "FileHash-SHA1": 305,
        "FileHash-SHA256": 362,
        "URL": 369,
        "hostname": 376,
        "domain": 193,
        "email": 13
      },
      "indicator_count": 1926,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "13 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bf6652beb00c62a9cb8b84",
      "name": "i cloned msudosos - IOC breakdown = Possible ELF/Prometei Botnet CnC Activity",
      "description": "",
      "modified": "2026-04-21T02:20:25.690000",
      "created": "2026-03-22T03:47:30.942000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "69bf4cc74c3d8f391a1a927c",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 308,
        "FileHash-SHA1": 305,
        "FileHash-SHA256": 362,
        "URL": 367,
        "hostname": 372,
        "domain": 192,
        "email": 13
      },
      "indicator_count": 1919,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "40 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://login.live.com/login.srf",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://login.live.com/login.srf",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780234096.2624624
}