{
  "type": "URL",
  "indicator": "https://login.live.com/ppsecure/deviceaddcredential.srf",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://login.live.com/ppsecure/deviceaddcredential.srf",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "alexa",
        "message": "Alexa rank: #18",
        "name": "Listed on Alexa"
      },
      {
        "source": "akamai",
        "message": "Akamai rank: #42",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain live.com",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain live.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 4001755339,
      "indicator": "https://login.live.com/ppsecure/deviceaddcredential.srf",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69ddd4754dde7f96064d1766",
          "name": "<r3.i.lencr.org/\\nExtension7>",
          "description": "The full text/ASCII text in the form of an unauthorised file has been published on the website of the European Union (EU) and its member states, the EU, as well as the UK.",
          "modified": "2026-05-14T05:17:06.212000",
          "created": "2026-04-14T05:45:25.306000",
          "tags": [
            "ascii text",
            "crlf line"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URI": 3,
            "CVE": 3,
            "email": 3,
            "FileHash-MD5": 175,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 749,
            "URL": 45,
            "hostname": 48,
            "domain": 8,
            "YARA": 1
          },
          "indicator_count": 1217,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "17 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ca38fb0db58d66ca0c73aa",
          "name": "Untitled.",
          "description": "Pulses are the latest in a series of web-based attacks, which have seen more than 1.5 million infections since its launch in 2008.. and the first of its kind.",
          "modified": "2026-04-29T08:14:54.179000",
          "created": "2026-03-30T08:48:59.142000",
          "tags": [
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "domain",
            "ip whois",
            "registrar",
            "domain names",
            "creation date",
            "thumbprint",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "cus cngts",
            "ogoogle trust",
            "llc validity",
            "subject public",
            "key info",
            "key algorithm",
            "server",
            "aaaa",
            "status",
            "domain status",
            "registrar abuse",
            "data",
            "date",
            "google",
            "levelblue",
            "alienvault otx"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 154,
            "domain": 170,
            "FileHash-SHA1": 155,
            "FileHash-MD5": 156,
            "FileHash-SHA256": 487,
            "URL": 322,
            "email": 6
          },
          "indicator_count": 1450,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "32 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 1344
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/live.com",
    "whois": "http://whois.domaintools.com/live.com",
    "domain": "live.com",
    "hostname": "login.live.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69ddd4754dde7f96064d1766",
      "name": "<r3.i.lencr.org/\\nExtension7>",
      "description": "The full text/ASCII text in the form of an unauthorised file has been published on the website of the European Union (EU) and its member states, the EU, as well as the UK.",
      "modified": "2026-05-14T05:17:06.212000",
      "created": "2026-04-14T05:45:25.306000",
      "tags": [
        "ascii text",
        "crlf line"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URI": 3,
        "CVE": 3,
        "email": 3,
        "FileHash-MD5": 175,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 749,
        "URL": 45,
        "hostname": 48,
        "domain": 8,
        "YARA": 1
      },
      "indicator_count": 1217,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "17 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ca38fb0db58d66ca0c73aa",
      "name": "Untitled.",
      "description": "Pulses are the latest in a series of web-based attacks, which have seen more than 1.5 million infections since its launch in 2008.. and the first of its kind.",
      "modified": "2026-04-29T08:14:54.179000",
      "created": "2026-03-30T08:48:59.142000",
      "tags": [
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "domain",
        "ip whois",
        "registrar",
        "domain names",
        "creation date",
        "thumbprint",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "cus cngts",
        "ogoogle trust",
        "llc validity",
        "subject public",
        "key info",
        "key algorithm",
        "server",
        "aaaa",
        "status",
        "domain status",
        "registrar abuse",
        "data",
        "date",
        "google",
        "levelblue",
        "alienvault otx"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 154,
        "domain": 170,
        "FileHash-SHA1": 155,
        "FileHash-MD5": 156,
        "FileHash-SHA256": 487,
        "URL": 322,
        "email": 6
      },
      "indicator_count": 1450,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "32 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://login.live.com/ppsecure/deviceaddcredential.srf",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://login.live.com/ppsecure/deviceaddcredential.srf",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780248789.7038097
}