{
  "type": "URL",
  "indicator": "https://whois.ca.fury.ca/runtime",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://whois.ca.fury.ca/runtime",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4126189342,
      "indicator": "https://whois.ca.fury.ca/runtime",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "698ef344417f9985660e698b",
          "name": "Pulse Data",
          "description": "A complete summary of all the key points in the analysis of the W32.virus, compiled by the University of California, Los Angeles, at the end of May, 2014, and published online.",
          "modified": "2026-03-28T07:23:23.210000",
          "created": "2026-02-13T09:47:48.788000",
          "tags": [
            "imphash",
            "file type",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "detections tls",
            "zeppelin"
          ],
          "references": [
            "",
            "4860f9c5ec1ab473f1d63d19a31c82798d65a8d2 Add to Pulse Pulses 2 AV Detections 1 IDS Detections 5 YARA Detections 3 Alerts 0 Analysis Overview Analysis Date 4 days ago File Score 12 Malicious Antivirus Detections TrojanDownloader:Win32/Tugspay.A IDS Detections TLS Handshake Failure 403 Forbidden Yara Detections Win32_PUA_Domaiq ,  aPLib ,  PECompact_2xx Alerts 31 Alerts antivm_display infostealer_browser infostealer_cookies procmem_yara static_pe_anomaly suricata_alert antivm_bochs_keys physical_drive_access "
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 646,
            "FileHash-SHA1": 604,
            "FileHash-SHA256": 1373,
            "hostname": 1143,
            "domain": 1381,
            "URL": 2537,
            "CVE": 101,
            "email": 25,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 7819,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "22 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68b60cdecf42fb532f2ceb12",
          "name": "U of A DataBreach Update - 11.13.25",
          "description": "Domain Analysis that serves as evidence of an on-going DataBreaches at the University of Alberta with associated references.\nAnalysis demonstrates abused critical infrastructure in the Province of Alberta stemming from UAlberta as detailed in this Pulse.",
          "modified": "2025-12-13T22:01:27.739000",
          "created": "2025-09-01T21:15:10.117000",
          "tags": [
            "as16509",
            "amazon02",
            "redirect",
            "tags",
            "as14618",
            "amazonaes",
            "search",
            "public",
            "search live",
            "api blog",
            "patch http",
            "please",
            "javascript",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "search api",
            "make sure",
            "domain",
            "and not",
            "page",
            "home search",
            "live api",
            "blog docs",
            "pricing login",
            "greynoise",
            "visualizer skip",
            "service status",
            "company blog",
            "us careers",
            "policies vpat",
            "slo privacy",
            "cookie patent",
            "copyright",
            "google privacy",
            "sandbox",
            "reputation",
            "phishing",
            "malware",
            "amazon web",
            "services",
            "warning icon",
            "share report",
            "systems",
            "cloudflare",
            "varnish",
            "nginx",
            "apache",
            "write",
            "virus",
            "trojan",
            "ransomware",
            "static",
            "analysis",
            "indicator of compromise",
            "ioc",
            "extraction",
            "emulation",
            "online",
            "submit",
            "sample",
            "download",
            "platform",
            "course",
            "program",
            "vxstream",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "UAlberta"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
            "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary",
            "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
            "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
            "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
            "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
            "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
            "https://viz.greynoise.io/query/AS3359",
            "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
            "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
            "https://www.urlvoid.com/dns-records-lookup/",
            "https://www.shodan.io/search?query=ualberta.ca",
            "https://dnsdumpster.com/",
            "https://bgpview.io/asn/3359#whois",
            "https://centralops.net/co/",
            "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
            "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
            "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
            "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
            "https://www.criminalip.io/asset/search?query=ualberta.ca",
            "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
            "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
            "https://whois.domaintools.com/ualberta.ca",
            "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
            "https://viewdns.info/iphistory/?domain=ualberta.ca",
            "https://viewdns.info/portscan/?host=ualberta.ca",
            "https://whois.easycounter.com/ualberta.ca",
            "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
            "https://who.is/whois/ualberta.ca",
            "https://www.robtex.com/en/dns-lookup/ca/ualberta",
            "https://www.whoxy.com/ualberta.ca",
            "https://reverseip.domaintools.com/search/?q=ualberta.ca",
            "https://bgp.he.net/dns/ualberta.ca",
            "https://intelx.io/?s=ualberta.ca",
            "https://pulsedive.com/indicator/?indicator=ualberta.ca",
            "https://web.archive.org/web/20250000000000*/ualberta.ca",
            "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
            "https://viewdns.info/traceroute/?domain=ualberta.ca",
            "https://centralops.net/co/DomainDossier.aspx",
            "https://search.odin.io/hosts?query=ualberta.ca",
            "https://www.merklemap.com/search?query=ualberta.ca&page=0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 92,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9901,
            "domain": 790,
            "email": 982,
            "hostname": 10520,
            "FileHash-MD5": 550,
            "FileHash-SHA256": 1726,
            "FileHash-SHA1": 519,
            "SSLCertFingerprint": 64,
            "CIDR": 26,
            "CVE": 12
          },
          "indicator_count": 25090,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "126 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ee5e9f8cfc5fbc73142660",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:30:55.471000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ee5ea4d51d4a1cabdb4ee9",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:31:00.172000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
        "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
        "bricked.wtf",
        "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
        "https://bgpview.io/asn/3359#whois",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
        "https://www.merklemap.com/search?query=ualberta.ca&page=0",
        "https://www.shodan.io/search?query=ualberta.ca",
        "http://api.jmtstudios.org/",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "https://who.is/whois/ualberta.ca",
        "https://viz.greynoise.io/query/AS3359",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "https://viewdns.info/traceroute/?domain=ualberta.ca",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "https://www.jmtstudios.org/farewell/",
        "https://intelx.io/?s=ualberta.ca",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary",
        "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
        "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
        "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
        "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
        "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
        "https://www.criminalip.io/asset/search?query=ualberta.ca",
        "4860f9c5ec1ab473f1d63d19a31c82798d65a8d2 Add to Pulse Pulses 2 AV Detections 1 IDS Detections 5 YARA Detections 3 Alerts 0 Analysis Overview Analysis Date 4 days ago File Score 12 Malicious Antivirus Detections TrojanDownloader:Win32/Tugspay.A IDS Detections TLS Handshake Failure 403 Forbidden Yara Detections Win32_PUA_Domaiq ,  aPLib ,  PECompact_2xx Alerts 31 Alerts antivm_display infostealer_browser infostealer_cookies procmem_yara static_pe_anomaly suricata_alert antivm_bochs_keys physical_drive_access ",
        "https://www.urlvoid.com/dns-records-lookup/",
        "https://viewdns.info/iphistory/?domain=ualberta.ca",
        "https://web.archive.org/web/20250000000000*/ualberta.ca",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party.",
        "https://whois.easycounter.com/ualberta.ca",
        "https://whois.domaintools.com/ualberta.ca",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
        "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
        "https://www.robtex.com/en/dns-lookup/ca/ualberta",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
        "https://bgp.he.net/dns/ualberta.ca",
        "https://centralops.net/co/DomainDossier.aspx",
        "https://viewdns.info/portscan/?host=ualberta.ca",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "https://centralops.net/co/",
        "https://reverseip.domaintools.com/search/?q=ualberta.ca",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "https://www.whoxy.com/ualberta.ca",
        "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://pulsedive.com/indicator/?indicator=ualberta.ca",
        "https://dnsdumpster.com/",
        "https://search.odin.io/hosts?query=ualberta.ca"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.malware.convagent-9981433-0",
            "Upadter",
            "Mydoom"
          ],
          "industries": [
            "Technology",
            "Education"
          ],
          "unique_indicators": 32477
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/fury.ca",
    "whois": "http://whois.domaintools.com/fury.ca",
    "domain": "fury.ca",
    "hostname": "whois.ca.fury.ca"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "698ef344417f9985660e698b",
      "name": "Pulse Data",
      "description": "A complete summary of all the key points in the analysis of the W32.virus, compiled by the University of California, Los Angeles, at the end of May, 2014, and published online.",
      "modified": "2026-03-28T07:23:23.210000",
      "created": "2026-02-13T09:47:48.788000",
      "tags": [
        "imphash",
        "file type",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "detections tls",
        "zeppelin"
      ],
      "references": [
        "",
        "4860f9c5ec1ab473f1d63d19a31c82798d65a8d2 Add to Pulse Pulses 2 AV Detections 1 IDS Detections 5 YARA Detections 3 Alerts 0 Analysis Overview Analysis Date 4 days ago File Score 12 Malicious Antivirus Detections TrojanDownloader:Win32/Tugspay.A IDS Detections TLS Handshake Failure 403 Forbidden Yara Detections Win32_PUA_Domaiq ,  aPLib ,  PECompact_2xx Alerts 31 Alerts antivm_display infostealer_browser infostealer_cookies procmem_yara static_pe_anomaly suricata_alert antivm_bochs_keys physical_drive_access "
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 646,
        "FileHash-SHA1": 604,
        "FileHash-SHA256": 1373,
        "hostname": 1143,
        "domain": 1381,
        "URL": 2537,
        "CVE": 101,
        "email": 25,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 7819,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "22 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68b60cdecf42fb532f2ceb12",
      "name": "U of A DataBreach Update - 11.13.25",
      "description": "Domain Analysis that serves as evidence of an on-going DataBreaches at the University of Alberta with associated references.\nAnalysis demonstrates abused critical infrastructure in the Province of Alberta stemming from UAlberta as detailed in this Pulse.",
      "modified": "2025-12-13T22:01:27.739000",
      "created": "2025-09-01T21:15:10.117000",
      "tags": [
        "as16509",
        "amazon02",
        "redirect",
        "tags",
        "as14618",
        "amazonaes",
        "search",
        "public",
        "search live",
        "api blog",
        "patch http",
        "please",
        "javascript",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "search api",
        "make sure",
        "domain",
        "and not",
        "page",
        "home search",
        "live api",
        "blog docs",
        "pricing login",
        "greynoise",
        "visualizer skip",
        "service status",
        "company blog",
        "us careers",
        "policies vpat",
        "slo privacy",
        "cookie patent",
        "copyright",
        "google privacy",
        "sandbox",
        "reputation",
        "phishing",
        "malware",
        "amazon web",
        "services",
        "warning icon",
        "share report",
        "systems",
        "cloudflare",
        "varnish",
        "nginx",
        "apache",
        "write",
        "virus",
        "trojan",
        "ransomware",
        "static",
        "analysis",
        "indicator of compromise",
        "ioc",
        "extraction",
        "emulation",
        "online",
        "submit",
        "sample",
        "download",
        "platform",
        "course",
        "program",
        "vxstream",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "UAlberta"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary",
        "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
        "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
        "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
        "https://viz.greynoise.io/query/AS3359",
        "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
        "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
        "https://www.urlvoid.com/dns-records-lookup/",
        "https://www.shodan.io/search?query=ualberta.ca",
        "https://dnsdumpster.com/",
        "https://bgpview.io/asn/3359#whois",
        "https://centralops.net/co/",
        "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
        "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
        "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
        "https://www.criminalip.io/asset/search?query=ualberta.ca",
        "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
        "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
        "https://whois.domaintools.com/ualberta.ca",
        "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
        "https://viewdns.info/iphistory/?domain=ualberta.ca",
        "https://viewdns.info/portscan/?host=ualberta.ca",
        "https://whois.easycounter.com/ualberta.ca",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
        "https://who.is/whois/ualberta.ca",
        "https://www.robtex.com/en/dns-lookup/ca/ualberta",
        "https://www.whoxy.com/ualberta.ca",
        "https://reverseip.domaintools.com/search/?q=ualberta.ca",
        "https://bgp.he.net/dns/ualberta.ca",
        "https://intelx.io/?s=ualberta.ca",
        "https://pulsedive.com/indicator/?indicator=ualberta.ca",
        "https://web.archive.org/web/20250000000000*/ualberta.ca",
        "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
        "https://viewdns.info/traceroute/?domain=ualberta.ca",
        "https://centralops.net/co/DomainDossier.aspx",
        "https://search.odin.io/hosts?query=ualberta.ca",
        "https://www.merklemap.com/search?query=ualberta.ca&page=0"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 92,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9901,
        "domain": 790,
        "email": 982,
        "hostname": 10520,
        "FileHash-MD5": 550,
        "FileHash-SHA256": 1726,
        "FileHash-SHA1": 519,
        "SSLCertFingerprint": 64,
        "CIDR": 26,
        "CVE": 12
      },
      "indicator_count": 25090,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "126 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ee5e9f8cfc5fbc73142660",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:30:55.471000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ee5ea4d51d4a1cabdb4ee9",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:31:00.172000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://whois.ca.fury.ca/runtime",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://whois.ca.fury.ca/runtime",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776606653.7383127
}