{
  "type": "URL",
  "indicator": "https://ualberta.ca/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ualberta.ca/",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "majestic",
        "message": "Whitelisted domain ualberta.ca",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3786749467,
      "indicator": "https://ualberta.ca/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "68b60cdecf42fb532f2ceb12",
          "name": "U of A DataBreach Update - 11.13.25",
          "description": "Domain Analysis that serves as evidence of an on-going DataBreaches at the University of Alberta with associated references.\nAnalysis demonstrates abused critical infrastructure in the Province of Alberta stemming from UAlberta as detailed in this Pulse.",
          "modified": "2025-12-13T22:01:27.739000",
          "created": "2025-09-01T21:15:10.117000",
          "tags": [
            "as16509",
            "amazon02",
            "redirect",
            "tags",
            "as14618",
            "amazonaes",
            "search",
            "public",
            "search live",
            "api blog",
            "patch http",
            "please",
            "javascript",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "search api",
            "make sure",
            "domain",
            "and not",
            "page",
            "home search",
            "live api",
            "blog docs",
            "pricing login",
            "greynoise",
            "visualizer skip",
            "service status",
            "company blog",
            "us careers",
            "policies vpat",
            "slo privacy",
            "cookie patent",
            "copyright",
            "google privacy",
            "sandbox",
            "reputation",
            "phishing",
            "malware",
            "amazon web",
            "services",
            "warning icon",
            "share report",
            "systems",
            "cloudflare",
            "varnish",
            "nginx",
            "apache",
            "write",
            "virus",
            "trojan",
            "ransomware",
            "static",
            "analysis",
            "indicator of compromise",
            "ioc",
            "extraction",
            "emulation",
            "online",
            "submit",
            "sample",
            "download",
            "platform",
            "course",
            "program",
            "vxstream",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "UAlberta"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
            "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary",
            "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
            "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
            "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
            "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
            "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
            "https://viz.greynoise.io/query/AS3359",
            "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
            "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
            "https://www.urlvoid.com/dns-records-lookup/",
            "https://www.shodan.io/search?query=ualberta.ca",
            "https://dnsdumpster.com/",
            "https://bgpview.io/asn/3359#whois",
            "https://centralops.net/co/",
            "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
            "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
            "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
            "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
            "https://www.criminalip.io/asset/search?query=ualberta.ca",
            "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
            "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
            "https://whois.domaintools.com/ualberta.ca",
            "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
            "https://viewdns.info/iphistory/?domain=ualberta.ca",
            "https://viewdns.info/portscan/?host=ualberta.ca",
            "https://whois.easycounter.com/ualberta.ca",
            "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
            "https://who.is/whois/ualberta.ca",
            "https://www.robtex.com/en/dns-lookup/ca/ualberta",
            "https://www.whoxy.com/ualberta.ca",
            "https://reverseip.domaintools.com/search/?q=ualberta.ca",
            "https://bgp.he.net/dns/ualberta.ca",
            "https://intelx.io/?s=ualberta.ca",
            "https://pulsedive.com/indicator/?indicator=ualberta.ca",
            "https://web.archive.org/web/20250000000000*/ualberta.ca",
            "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
            "https://viewdns.info/traceroute/?domain=ualberta.ca",
            "https://centralops.net/co/DomainDossier.aspx",
            "https://search.odin.io/hosts?query=ualberta.ca",
            "https://www.merklemap.com/search?query=ualberta.ca&page=0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 92,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9901,
            "domain": 790,
            "email": 982,
            "hostname": 10520,
            "FileHash-MD5": 550,
            "FileHash-SHA256": 1726,
            "FileHash-SHA1": 519,
            "SSLCertFingerprint": 64,
            "CIDR": 26,
            "CVE": 12
          },
          "indicator_count": 25090,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "127 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66538f4db3a8cf5fb35edbd7",
          "name": "IOCs sampled w. Any[.]runs sandbox from 'logging into my UAlberta account'",
          "description": "UAlberta - IOCs sampled from Any[.]Runs VM Sandbox to extract IOCs from the act of 'logging into my U of A Gmail Account' (Rogue), further analysis conducted on pcap file.\n\n-05.26.24: Need to upload pcap file IOCs (Done & Retested on 06.04.24)\n\n-CVE 2016-0101, CVE 2004-0932",
          "modified": "2025-10-16T15:04:01.169000",
          "created": "2024-05-26T19:36:45.007000",
          "tags": [
            "please",
            "javascript",
            "relaystatehttps",
            "UAlberta"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e/iocs",
            "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e/graph",
            "https://www.virustotal.com/gui/collection/7282647dbf53915db766e8afd03c485ab3596962670c15c427206ce174ca78f0/iocs",
            "hxxps://tria[.]ge/240604-tnwvzsce3s",
            "hxxps://viz[.]greynoise[.]io/analysis/02c0537c-d5b6-4881-bdde-9ed84a978cfe",
            "Report ID: ca0154b1-39cc-44f5-9f54-a669132dff60",
            "hxxps://lab[.]dynamite[.]ai/pcaps/ae3b422f-4d10-4ebc-bf35-5e19d0aaae75",
            "hxxps://app[.]any[.]run/tasks/60a27c5e-ddd3-44d8-a4af-a5f90cdd4660",
            "https://www.virustotal.com/graph/embed/g1283d60e0d064912af05e1ed528df7b7d1af3298065040ce9863afbea677becd?theme=dark",
            "hxxps://viz.greynoise.io/analysis/0ec05e79-be67-4f45-82c4-96ca96aa007c",
            "https://urlscan.io/user/submit/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 128,
            "FileHash-MD5": 12,
            "FileHash-SHA1": 12,
            "FileHash-SHA256": 635,
            "URL": 250,
            "hostname": 235,
            "CIDR": 27
          },
          "indicator_count": 1299,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 131,
          "modified_text": "185 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68b282764066330381194dfe",
          "name": "SSL Server Test: ualberta.ca (Powered by Qualys SSL Labs) - 08.29.25",
          "description": "This server is designed to protect the security of your computer, mobile phone, tablet and online banking systems from being attacked by malicious software, or MITM, as well as using the secure net.",
          "modified": "2025-09-28T00:00:13.359000",
          "created": "2025-08-30T04:47:50.847000",
          "tags": [
            "sha256",
            "r rsa",
            "x25519 fs",
            "fs safari",
            "ecdh x25519",
            "android",
            "fs ie",
            "phone",
            "safari",
            "no sni",
            "openssl",
            "macos",
            "UAlberta"
          ],
          "references": [
            "https://www.ssllabs.com/ssltest/analyze.html?d=ualberta.ca"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1,
            "FileHash-SHA256": 5,
            "domain": 9,
            "URL": 39,
            "hostname": 194
          },
          "indicator_count": 251,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 128,
          "modified_text": "203 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6647908c09468f42bc1249f1",
          "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
          "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
          "modified": "2025-03-01T04:59:57.222000",
          "created": "2024-05-17T17:14:52.317000",
          "tags": [
            "false",
            "true",
            "visible",
            "application",
            "microsoft teams",
            "microsoft azure",
            "office",
            "service",
            "dynamics",
            "hidden",
            "android",
            "explorer",
            "write",
            "connector",
            "test",
            "sharepoint",
            "live",
            "meister",
            "tools",
            "desktop",
            "spark",
            "front",
            "enterprise",
            "designer",
            "atlas",
            "premium",
            "assistant",
            "allow",
            "azureadmyorg",
            "game",
            "verify",
            "microsoft power",
            "channelsurfcli",
            "mtd1",
            "file transfer",
            "magnus",
            "microsoft crm",
            "youth"
          ],
          "references": [
            "All - EnterpriseAppsList.csv",
            "AppRegistrationList.csv",
            "https://tria.ge/240517-vc7c1shc62/behavioral1",
            "https://tria.ge/240517-vdwb5shc71/behavioral1",
            "https://tria.ge/240517-vqxezaaa33/behavioral1",
            "https://tria.ge/240517-t9pc2ahb2t",
            "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
            "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
            "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
            "Thor Scan: S-I9VvMTB6cZU",
            "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
            "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
            "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
            "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
            "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
            "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
            "https://tria.ge/240521-q4s79agb25/static1",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
            "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
            "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
            "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
            "https://www.hudsonrock.com/search?domain=ualberta.ca",
            "https://www.criminalip.io/domain/report?scan_id=13798622",
            "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
            "https://urlscan.io/search/#ualberta.ca",
            "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
            "https://sitereport.netcraft.com/?url=http://ualberta.ca",
            "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
            "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
            "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
            "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Healthcare",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 7,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1703,
            "FileHash-SHA256": 90472,
            "URL": 99185,
            "domain": 82954,
            "hostname": 39041,
            "FileHash-SHA1": 1624,
            "email": 4658,
            "CVE": 12
          },
          "indicator_count": 319649,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "414 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6564fa9a3d90d1cd14928b16",
          "name": "Lumma \u2022 University of Alberta \"No Problems\" | T1036 - Masquerading",
          "description": "I was contacted on this forum re: University of Alberta issue. Based on research  www.ualberta.ca redirects. There hasn't been a research effort for redirect. I researched a spoofed website. After viewing senders request, my devices operating system changed, isn't recognized by any accounts, keyloggers.\nFound: Anonymizers, Redirector, Masquerading, Network RAT, Serious Social Engineering, Botnetwork Army, Stealers, Lumma and weirdly targeted  'Tsara Brashears' as a malicious link on a spoofed University in Canada, UCHealth Colorado links.",
          "modified": "2023-12-27T19:03:02.665000",
          "created": "2023-11-27T20:22:50.050000",
          "tags": [
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json url",
            "urls",
            "detection list",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "malicious site",
            "phishing site",
            "malicious url",
            "phishing",
            "riskware",
            "presenoker",
            "artemis",
            "agent",
            "unsafe",
            "opencandy",
            "ursnif",
            "wacatac",
            "team",
            "facebook",
            "runescape",
            "service",
            "downldr",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "installcore",
            "fareit",
            "secrisk",
            "exploit",
            "mimikatz",
            "sorano",
            "emotet",
            "genkryptik",
            "fuery",
            "dbatloader",
            "qakbot",
            "alexa",
            "malicious",
            "union",
            "lumma stealer",
            "fusioncore",
            "cleaner",
            "azorult",
            "bank",
            "blacknet rat",
            "stealer",
            "iframe",
            "trojanspy",
            "analysis",
            "united",
            "firehol",
            "proxy",
            "mail spammer",
            "downloader",
            "malware site",
            "meterpreter",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "unruy",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "generic",
            "dnspionage",
            "expirestue",
            "path",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "alberta",
            "university",
            "edmonton",
            "html info",
            "alberta meta",
            "tags",
            "trackers google",
            "tag manager",
            "gtmkr32",
            "blacklist",
            "low risk",
            "apache",
            "domain",
            "malware found",
            "unknown",
            "minimal low",
            "security risk",
            "medium high",
            "critical",
            "protect",
            "college",
            "mtis",
            "faculties",
            "research",
            "health",
            "a about",
            "news",
            "events",
            "sport",
            "life",
            "find",
            "story",
            "tools",
            "getprocaddress",
            "indicator",
            "prefetch8",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "pattern match",
            "file",
            "date",
            "factory",
            "hybrid",
            "general",
            "cookie",
            "click",
            "strings",
            "djin",
            "no data",
            "tag count",
            "sample",
            "samples",
            "netsky",
            "cobalt strike",
            "xrat",
            "fakealert",
            "raccoon",
            "redline stealer",
            "metastealer",
            "icedid",
            "quasar rat",
            "acint",
            "anonymizer",
            "blockchain",
            "social engineering",
            "read c",
            "search",
            "show",
            "medium",
            "entries",
            "whitelisted",
            "memcommit",
            "delete",
            "yara detections",
            "next",
            "dock",
            "write",
            "execution",
            "copy",
            "south carolina",
            "federal credit",
            "team proxy",
            "static engine",
            "covid19",
            "redirector",
            "suspic",
            "tue mar",
            "zbot",
            "size68b type",
            "count blacklist",
            "tag tag",
            "rejected sample",
            "icon",
            "analyzed",
            "hwp support",
            "falcon sandbox",
            "multi scan",
            "update",
            "view details",
            "upgrade",
            "blacklist https",
            "keyloggers"
          ],
          "references": [
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
            "uchealth.com",
            "http://michaela.young@uchealth.com",
            "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
            "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
            "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "MimiKatz",
              "display_name": "MimiKatz",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Network RAT",
              "display_name": "Network RAT",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Raccoon",
              "display_name": "Raccoon",
              "target": null
            },
            {
              "id": "OpenCandy",
              "display_name": "OpenCandy",
              "target": null
            },
            {
              "id": "Meterpreter",
              "display_name": "Meterpreter",
              "target": null
            },
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "TrojanX",
              "display_name": "TrojanX",
              "target": null
            },
            {
              "id": "BlackNET RAT",
              "display_name": "BlackNET RAT",
              "target": null
            },
            {
              "id": "Brontok",
              "display_name": "Brontok",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1588.004",
              "name": "Digital Certificates",
              "display_name": "T1588.004 - Digital Certificates"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            },
            {
              "id": "T1126",
              "name": "Network Share Connection Removal",
              "display_name": "T1126 - Network Share Connection Removal"
            },
            {
              "id": "T1136",
              "name": "Create Account",
              "display_name": "T1136 - Create Account"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1134.004",
              "name": "Parent PID Spoofing",
              "display_name": "T1134.004 - Parent PID Spoofing"
            }
          ],
          "industries": [
            "Education",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 320,
            "FileHash-SHA1": 172,
            "FileHash-SHA256": 4302,
            "URL": 8243,
            "CIDR": 1,
            "domain": 1742,
            "hostname": 2270,
            "CVE": 18,
            "SSLCertFingerprint": 3,
            "email": 4
          },
          "indicator_count": 17075,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "844 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "hxxps://tria[.]ge/240604-tnwvzsce3s",
        "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
        "https://www.robtex.com/en/dns-lookup/ca/ualberta",
        "https://www.shodan.io/search?query=ualberta.ca",
        "https://who.is/whois/ualberta.ca",
        "http://michaela.young@uchealth.com",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://bgpview.io/asn/3359#whois",
        "https://pulsedive.com/indicator/?indicator=ualberta.ca",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "hxxps://app[.]any[.]run/tasks/60a27c5e-ddd3-44d8-a4af-a5f90cdd4660",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://centralops.net/co/",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
        "https://www.urlvoid.com/dns-records-lookup/",
        "https://whois.easycounter.com/ualberta.ca",
        "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
        "https://viewdns.info/traceroute/?domain=ualberta.ca",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://search.odin.io/hosts?query=ualberta.ca",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://dnsdumpster.com/",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e/graph",
        "https://urlscan.io/user/submit/",
        "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf",
        "https://www.virustotal.com/gui/collection/7282647dbf53915db766e8afd03c485ab3596962670c15c427206ce174ca78f0/iocs",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS3359",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://whois.domaintools.com/ualberta.ca",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
        "https://www.merklemap.com/search?query=ualberta.ca&page=0",
        "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
        "https://bgp.he.net/dns/ualberta.ca",
        "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
        "https://viewdns.info/iphistory/?domain=ualberta.ca",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "All - EnterpriseAppsList.csv",
        "https://centralops.net/co/DomainDossier.aspx",
        "uchealth.com",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://reverseip.domaintools.com/search/?q=ualberta.ca",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e/iocs",
        "hxxps://lab[.]dynamite[.]ai/pcaps/ae3b422f-4d10-4ebc-bf35-5e19d0aaae75",
        "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "Report ID: ca0154b1-39cc-44f5-9f54-a669132dff60",
        "https://intelx.io/?s=ualberta.ca",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://www.criminalip.io/asset/search?query=ualberta.ca",
        "https://www.virustotal.com/graph/embed/g1283d60e0d064912af05e1ed528df7b7d1af3298065040ce9863afbea677becd?theme=dark",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://www.whoxy.com/ualberta.ca",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "hxxps://viz.greynoise.io/analysis/0ec05e79-be67-4f45-82c4-96ca96aa007c",
        "hxxps://viz[.]greynoise[.]io/analysis/02c0537c-d5b6-4881-bdde-9ed84a978cfe",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
        "https://www.ssllabs.com/ssltest/analyze.html?d=ualberta.ca",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
        "https://urlscan.io/search/#ualberta.ca",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary",
        "https://web.archive.org/web/20250000000000*/ualberta.ca",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
        "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
        "AppRegistrationList.csv",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://viewdns.info/portscan/?host=ualberta.ca",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Redline stealer",
            "Opencandy",
            "Quasar rat",
            "Qakbot",
            "Trojanspy",
            "Blacknet rat",
            "Network rat",
            "Mimikatz",
            "Lumma stealer",
            "Emotet",
            "Brontok",
            "Raccoon",
            "Trojanx",
            "Meterpreter",
            "Unruy"
          ],
          "industries": [
            "Healthcare",
            "Telecommunications",
            "Education",
            "Government",
            "Technology"
          ],
          "unique_indicators": 69635
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ualberta.ca",
    "whois": "http://whois.domaintools.com/ualberta.ca",
    "domain": "ualberta.ca",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "68b60cdecf42fb532f2ceb12",
      "name": "U of A DataBreach Update - 11.13.25",
      "description": "Domain Analysis that serves as evidence of an on-going DataBreaches at the University of Alberta with associated references.\nAnalysis demonstrates abused critical infrastructure in the Province of Alberta stemming from UAlberta as detailed in this Pulse.",
      "modified": "2025-12-13T22:01:27.739000",
      "created": "2025-09-01T21:15:10.117000",
      "tags": [
        "as16509",
        "amazon02",
        "redirect",
        "tags",
        "as14618",
        "amazonaes",
        "search",
        "public",
        "search live",
        "api blog",
        "patch http",
        "please",
        "javascript",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "search api",
        "make sure",
        "domain",
        "and not",
        "page",
        "home search",
        "live api",
        "blog docs",
        "pricing login",
        "greynoise",
        "visualizer skip",
        "service status",
        "company blog",
        "us careers",
        "policies vpat",
        "slo privacy",
        "cookie patent",
        "copyright",
        "google privacy",
        "sandbox",
        "reputation",
        "phishing",
        "malware",
        "amazon web",
        "services",
        "warning icon",
        "share report",
        "systems",
        "cloudflare",
        "varnish",
        "nginx",
        "apache",
        "write",
        "virus",
        "trojan",
        "ransomware",
        "static",
        "analysis",
        "indicator of compromise",
        "ioc",
        "extraction",
        "emulation",
        "online",
        "submit",
        "sample",
        "download",
        "platform",
        "course",
        "program",
        "vxstream",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "UAlberta"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary",
        "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
        "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
        "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
        "https://viz.greynoise.io/query/AS3359",
        "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
        "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
        "https://www.urlvoid.com/dns-records-lookup/",
        "https://www.shodan.io/search?query=ualberta.ca",
        "https://dnsdumpster.com/",
        "https://bgpview.io/asn/3359#whois",
        "https://centralops.net/co/",
        "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
        "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
        "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
        "https://www.criminalip.io/asset/search?query=ualberta.ca",
        "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
        "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
        "https://whois.domaintools.com/ualberta.ca",
        "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
        "https://viewdns.info/iphistory/?domain=ualberta.ca",
        "https://viewdns.info/portscan/?host=ualberta.ca",
        "https://whois.easycounter.com/ualberta.ca",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
        "https://who.is/whois/ualberta.ca",
        "https://www.robtex.com/en/dns-lookup/ca/ualberta",
        "https://www.whoxy.com/ualberta.ca",
        "https://reverseip.domaintools.com/search/?q=ualberta.ca",
        "https://bgp.he.net/dns/ualberta.ca",
        "https://intelx.io/?s=ualberta.ca",
        "https://pulsedive.com/indicator/?indicator=ualberta.ca",
        "https://web.archive.org/web/20250000000000*/ualberta.ca",
        "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
        "https://viewdns.info/traceroute/?domain=ualberta.ca",
        "https://centralops.net/co/DomainDossier.aspx",
        "https://search.odin.io/hosts?query=ualberta.ca",
        "https://www.merklemap.com/search?query=ualberta.ca&page=0"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 92,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9901,
        "domain": 790,
        "email": 982,
        "hostname": 10520,
        "FileHash-MD5": 550,
        "FileHash-SHA256": 1726,
        "FileHash-SHA1": 519,
        "SSLCertFingerprint": 64,
        "CIDR": 26,
        "CVE": 12
      },
      "indicator_count": 25090,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "127 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66538f4db3a8cf5fb35edbd7",
      "name": "IOCs sampled w. Any[.]runs sandbox from 'logging into my UAlberta account'",
      "description": "UAlberta - IOCs sampled from Any[.]Runs VM Sandbox to extract IOCs from the act of 'logging into my U of A Gmail Account' (Rogue), further analysis conducted on pcap file.\n\n-05.26.24: Need to upload pcap file IOCs (Done & Retested on 06.04.24)\n\n-CVE 2016-0101, CVE 2004-0932",
      "modified": "2025-10-16T15:04:01.169000",
      "created": "2024-05-26T19:36:45.007000",
      "tags": [
        "please",
        "javascript",
        "relaystatehttps",
        "UAlberta"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e/iocs",
        "https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e/graph",
        "https://www.virustotal.com/gui/collection/7282647dbf53915db766e8afd03c485ab3596962670c15c427206ce174ca78f0/iocs",
        "hxxps://tria[.]ge/240604-tnwvzsce3s",
        "hxxps://viz[.]greynoise[.]io/analysis/02c0537c-d5b6-4881-bdde-9ed84a978cfe",
        "Report ID: ca0154b1-39cc-44f5-9f54-a669132dff60",
        "hxxps://lab[.]dynamite[.]ai/pcaps/ae3b422f-4d10-4ebc-bf35-5e19d0aaae75",
        "hxxps://app[.]any[.]run/tasks/60a27c5e-ddd3-44d8-a4af-a5f90cdd4660",
        "https://www.virustotal.com/graph/embed/g1283d60e0d064912af05e1ed528df7b7d1af3298065040ce9863afbea677becd?theme=dark",
        "hxxps://viz.greynoise.io/analysis/0ec05e79-be67-4f45-82c4-96ca96aa007c",
        "https://urlscan.io/user/submit/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 128,
        "FileHash-MD5": 12,
        "FileHash-SHA1": 12,
        "FileHash-SHA256": 635,
        "URL": 250,
        "hostname": 235,
        "CIDR": 27
      },
      "indicator_count": 1299,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 131,
      "modified_text": "185 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68b282764066330381194dfe",
      "name": "SSL Server Test: ualberta.ca (Powered by Qualys SSL Labs) - 08.29.25",
      "description": "This server is designed to protect the security of your computer, mobile phone, tablet and online banking systems from being attacked by malicious software, or MITM, as well as using the secure net.",
      "modified": "2025-09-28T00:00:13.359000",
      "created": "2025-08-30T04:47:50.847000",
      "tags": [
        "sha256",
        "r rsa",
        "x25519 fs",
        "fs safari",
        "ecdh x25519",
        "android",
        "fs ie",
        "phone",
        "safari",
        "no sni",
        "openssl",
        "macos",
        "UAlberta"
      ],
      "references": [
        "https://www.ssllabs.com/ssltest/analyze.html?d=ualberta.ca"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 2,
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1,
        "FileHash-SHA256": 5,
        "domain": 9,
        "URL": 39,
        "hostname": 194
      },
      "indicator_count": 251,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 128,
      "modified_text": "203 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6647908c09468f42bc1249f1",
      "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
      "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
      "modified": "2025-03-01T04:59:57.222000",
      "created": "2024-05-17T17:14:52.317000",
      "tags": [
        "false",
        "true",
        "visible",
        "application",
        "microsoft teams",
        "microsoft azure",
        "office",
        "service",
        "dynamics",
        "hidden",
        "android",
        "explorer",
        "write",
        "connector",
        "test",
        "sharepoint",
        "live",
        "meister",
        "tools",
        "desktop",
        "spark",
        "front",
        "enterprise",
        "designer",
        "atlas",
        "premium",
        "assistant",
        "allow",
        "azureadmyorg",
        "game",
        "verify",
        "microsoft power",
        "channelsurfcli",
        "mtd1",
        "file transfer",
        "magnus",
        "microsoft crm",
        "youth"
      ],
      "references": [
        "All - EnterpriseAppsList.csv",
        "AppRegistrationList.csv",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://urlscan.io/search/#ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Healthcare",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 7,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1703,
        "FileHash-SHA256": 90472,
        "URL": 99185,
        "domain": 82954,
        "hostname": 39041,
        "FileHash-SHA1": 1624,
        "email": 4658,
        "CVE": 12
      },
      "indicator_count": 319649,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "414 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6564fa9a3d90d1cd14928b16",
      "name": "Lumma \u2022 University of Alberta \"No Problems\" | T1036 - Masquerading",
      "description": "I was contacted on this forum re: University of Alberta issue. Based on research  www.ualberta.ca redirects. There hasn't been a research effort for redirect. I researched a spoofed website. After viewing senders request, my devices operating system changed, isn't recognized by any accounts, keyloggers.\nFound: Anonymizers, Redirector, Masquerading, Network RAT, Serious Social Engineering, Botnetwork Army, Stealers, Lumma and weirdly targeted  'Tsara Brashears' as a malicious link on a spoofed University in Canada, UCHealth Colorado links.",
      "modified": "2023-12-27T19:03:02.665000",
      "created": "2023-11-27T20:22:50.050000",
      "tags": [
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json url",
        "urls",
        "detection list",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "malicious site",
        "phishing site",
        "malicious url",
        "phishing",
        "riskware",
        "presenoker",
        "artemis",
        "agent",
        "unsafe",
        "opencandy",
        "ursnif",
        "wacatac",
        "team",
        "facebook",
        "runescape",
        "service",
        "downldr",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "installcore",
        "fareit",
        "secrisk",
        "exploit",
        "mimikatz",
        "sorano",
        "emotet",
        "genkryptik",
        "fuery",
        "dbatloader",
        "qakbot",
        "alexa",
        "malicious",
        "union",
        "lumma stealer",
        "fusioncore",
        "cleaner",
        "azorult",
        "bank",
        "blacknet rat",
        "stealer",
        "iframe",
        "trojanspy",
        "analysis",
        "united",
        "firehol",
        "proxy",
        "mail spammer",
        "downloader",
        "malware site",
        "meterpreter",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "unruy",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "generic",
        "dnspionage",
        "expirestue",
        "path",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "alberta",
        "university",
        "edmonton",
        "html info",
        "alberta meta",
        "tags",
        "trackers google",
        "tag manager",
        "gtmkr32",
        "blacklist",
        "low risk",
        "apache",
        "domain",
        "malware found",
        "unknown",
        "minimal low",
        "security risk",
        "medium high",
        "critical",
        "protect",
        "college",
        "mtis",
        "faculties",
        "research",
        "health",
        "a about",
        "news",
        "events",
        "sport",
        "life",
        "find",
        "story",
        "tools",
        "getprocaddress",
        "indicator",
        "prefetch8",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "pattern match",
        "file",
        "date",
        "factory",
        "hybrid",
        "general",
        "cookie",
        "click",
        "strings",
        "djin",
        "no data",
        "tag count",
        "sample",
        "samples",
        "netsky",
        "cobalt strike",
        "xrat",
        "fakealert",
        "raccoon",
        "redline stealer",
        "metastealer",
        "icedid",
        "quasar rat",
        "acint",
        "anonymizer",
        "blockchain",
        "social engineering",
        "read c",
        "search",
        "show",
        "medium",
        "entries",
        "whitelisted",
        "memcommit",
        "delete",
        "yara detections",
        "next",
        "dock",
        "write",
        "execution",
        "copy",
        "south carolina",
        "federal credit",
        "team proxy",
        "static engine",
        "covid19",
        "redirector",
        "suspic",
        "tue mar",
        "zbot",
        "size68b type",
        "count blacklist",
        "tag tag",
        "rejected sample",
        "icon",
        "analyzed",
        "hwp support",
        "falcon sandbox",
        "multi scan",
        "update",
        "view details",
        "upgrade",
        "blacklist https",
        "keyloggers"
      ],
      "references": [
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
        "uchealth.com",
        "http://michaela.young@uchealth.com",
        "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
        "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
        "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "MimiKatz",
          "display_name": "MimiKatz",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "Network RAT",
          "display_name": "Network RAT",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Raccoon",
          "display_name": "Raccoon",
          "target": null
        },
        {
          "id": "OpenCandy",
          "display_name": "OpenCandy",
          "target": null
        },
        {
          "id": "Meterpreter",
          "display_name": "Meterpreter",
          "target": null
        },
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "TrojanX",
          "display_name": "TrojanX",
          "target": null
        },
        {
          "id": "BlackNET RAT",
          "display_name": "BlackNET RAT",
          "target": null
        },
        {
          "id": "Brontok",
          "display_name": "Brontok",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1588.004",
          "name": "Digital Certificates",
          "display_name": "T1588.004 - Digital Certificates"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        },
        {
          "id": "T1126",
          "name": "Network Share Connection Removal",
          "display_name": "T1126 - Network Share Connection Removal"
        },
        {
          "id": "T1136",
          "name": "Create Account",
          "display_name": "T1136 - Create Account"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1134.004",
          "name": "Parent PID Spoofing",
          "display_name": "T1134.004 - Parent PID Spoofing"
        }
      ],
      "industries": [
        "Education",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 83,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 320,
        "FileHash-SHA1": 172,
        "FileHash-SHA256": 4302,
        "URL": 8243,
        "CIDR": 1,
        "domain": 1742,
        "hostname": 2270,
        "CVE": 18,
        "SSLCertFingerprint": 3,
        "email": 4
      },
      "indicator_count": 17075,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "844 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ualberta.ca/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ualberta.ca/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641203.8794577
}