{
  "type": "URL",
  "indicator": "https://www.facebook.com/ualberta",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.facebook.com/ualberta",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "alexa",
        "message": "Alexa rank: #7",
        "name": "Listed on Alexa"
      },
      {
        "source": "akamai",
        "message": "Akamai rank: #5",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain facebook.com",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain facebook.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3786748475,
      "indicator": "https://www.facebook.com/ualberta",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "68b60cdecf42fb532f2ceb12",
          "name": "U of A DataBreach Update - 11.13.25",
          "description": "Domain Analysis that serves as evidence of an on-going DataBreaches at the University of Alberta with associated references.\nAnalysis demonstrates abused critical infrastructure in the Province of Alberta stemming from UAlberta as detailed in this Pulse.",
          "modified": "2025-12-13T22:01:27.739000",
          "created": "2025-09-01T21:15:10.117000",
          "tags": [
            "as16509",
            "amazon02",
            "redirect",
            "tags",
            "as14618",
            "amazonaes",
            "search",
            "public",
            "search live",
            "api blog",
            "patch http",
            "please",
            "javascript",
            "url",
            "website",
            "web",
            "scanner",
            "analyze",
            "analyzer",
            "search api",
            "make sure",
            "domain",
            "and not",
            "page",
            "home search",
            "live api",
            "blog docs",
            "pricing login",
            "greynoise",
            "visualizer skip",
            "service status",
            "company blog",
            "us careers",
            "policies vpat",
            "slo privacy",
            "cookie patent",
            "copyright",
            "google privacy",
            "sandbox",
            "reputation",
            "phishing",
            "malware",
            "amazon web",
            "services",
            "warning icon",
            "share report",
            "systems",
            "cloudflare",
            "varnish",
            "nginx",
            "apache",
            "write",
            "virus",
            "trojan",
            "ransomware",
            "static",
            "analysis",
            "indicator of compromise",
            "ioc",
            "extraction",
            "emulation",
            "online",
            "submit",
            "sample",
            "download",
            "platform",
            "course",
            "program",
            "vxstream",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "UAlberta"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
            "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary",
            "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
            "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
            "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
            "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
            "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
            "https://viz.greynoise.io/query/AS3359",
            "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
            "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
            "https://www.urlvoid.com/dns-records-lookup/",
            "https://www.shodan.io/search?query=ualberta.ca",
            "https://dnsdumpster.com/",
            "https://bgpview.io/asn/3359#whois",
            "https://centralops.net/co/",
            "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
            "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
            "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
            "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
            "https://www.criminalip.io/asset/search?query=ualberta.ca",
            "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
            "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
            "https://whois.domaintools.com/ualberta.ca",
            "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
            "https://viewdns.info/iphistory/?domain=ualberta.ca",
            "https://viewdns.info/portscan/?host=ualberta.ca",
            "https://whois.easycounter.com/ualberta.ca",
            "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
            "https://who.is/whois/ualberta.ca",
            "https://www.robtex.com/en/dns-lookup/ca/ualberta",
            "https://www.whoxy.com/ualberta.ca",
            "https://reverseip.domaintools.com/search/?q=ualberta.ca",
            "https://bgp.he.net/dns/ualberta.ca",
            "https://intelx.io/?s=ualberta.ca",
            "https://pulsedive.com/indicator/?indicator=ualberta.ca",
            "https://web.archive.org/web/20250000000000*/ualberta.ca",
            "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
            "https://viewdns.info/traceroute/?domain=ualberta.ca",
            "https://centralops.net/co/DomainDossier.aspx",
            "https://search.odin.io/hosts?query=ualberta.ca",
            "https://www.merklemap.com/search?query=ualberta.ca&page=0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 92,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9901,
            "domain": 790,
            "email": 982,
            "hostname": 10520,
            "FileHash-MD5": 550,
            "FileHash-SHA256": 1726,
            "FileHash-SHA1": 519,
            "SSLCertFingerprint": 64,
            "CIDR": 26,
            "CVE": 12
          },
          "indicator_count": 25090,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "127 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68198fe998b6e1fd28c5599c",
          "name": "The Open House that opens doors. Opublikuj Odpowiedz Saturday, October 15",
          "description": "The full text of the text-free version of Google Tag Manager, which was published on Wednesday, has been published online by Google's parent company, Alphabet, for the first time in its history.",
          "modified": "2025-06-05T00:04:02.181000",
          "created": "2025-05-06T04:28:25.685000",
          "tags": [
            "span",
            "script",
            "button",
            "university",
            "programs",
            "research",
            "alberta",
            "date",
            "back",
            "main menu",
            "union",
            "tools",
            "main",
            "canvas",
            "crisis",
            "footer",
            "iframe",
            "meta",
            "body",
            "school",
            "sport",
            "life",
            "energy",
            "contact",
            "small",
            "find",
            "null",
            "calendar"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 262,
            "domain": 11,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 1,
            "URL": 190,
            "hostname": 23
          },
          "indicator_count": 489,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "318 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67db9be18168bc23126a0f17",
          "name": "Falcon Sandbox (Hybrid Analysis), FileScan[.]io & URLScan[.]io - UAlberta[.]ca domain analysis",
          "description": "Domain Analysis of hxxp://ualberta[.]ca w. Hybrid Analysis, Filescan, URLscan\n-Followed up w. analysis of previously submitted URLscan submissions w. an analysis by Greynoise[.]io (up to 03.19.25)\n-Greynoise yielded (from URLScan 120 Identified & 10 Unknowns) - the results classified as RIOTS appear to be confounded (potential abuse of Amazon Web Services in combination w. other cloud provider services.\n-It appears just visiting and/or touching this domain is - generally not recommended\n-Results from PulseDive -> Redirects to: https://www.ualberta[.]ca/en/index.html // SSL certificate found: ualberta[.]ca and 239 more. Edmonton, Canada, University of Alberta. dnsmaster@ualberta.ca\neasyDNS Technologies Inc. Amazon ALB, Amazon Cloudfront, Apache HTTP Server, Bootstrap, Coveo, Crazy Egg, Facebook Pixel, Font Awesome, Google Analytics, Google Font API, jQuery, Linkedin Insight Tag, Microsoft Clarity, Open Graph, TikTok Pixel, Twitter Ads",
          "modified": "2025-04-19T04:02:16.037000",
          "created": "2025-03-20T04:38:57.551000",
          "tags": [
            "as16509",
            "amazon02",
            "redirect",
            "as14618",
            "amazonaes",
            "search",
            "public",
            "home search",
            "live api",
            "blog docs",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "pcap processing",
            "ansi",
            "pcap",
            "gecko",
            "win64",
            "khtml",
            "windows nt",
            "brand",
            "prefetch8 ansi",
            "microsoft edge",
            "date",
            "cookie",
            "mozilla",
            "suspicious",
            "comspec",
            "window",
            "model",
            "hybrid",
            "accept",
            "hacked",
            "starfield",
            "encrypt",
            "close",
            "click",
            "twitter",
            "hosts",
            "service",
            "general",
            "path",
            "union",
            "dest",
            "strings",
            "contact"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43/67db93032dc368d2d80c3df1",
            "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
            "https://www.filescan.io/uploads/67db2f67b93e688233ef36e9/reports/7e4e4377-5eb9-48a7-848d-bfdca4fb244c/ioc",
            "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43",
            "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43/67db93032dc368d2d80c3df1",
            "https://viz.greynoise.io/analysis/5692e934-322f-48b9-bd9b-556e653ff5b6",
            "https://pulsedive.com/ioc/ualberta.ca"
          ],
          "public": 1,
          "adversary": "dosdean@ualberta[.]ca // ciso@ualberta[.]ca",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [
            "Education",
            "Technology",
            "Government",
            "Agriculture",
            "Healthcare",
            "Chemical",
            "Finance",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 897,
            "domain": 37,
            "email": 34,
            "hostname": 396,
            "FileHash-MD5": 71,
            "FileHash-SHA1": 69,
            "FileHash-SHA256": 69,
            "SSLCertFingerprint": 23
          },
          "indicator_count": 1596,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "365 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6614565faf9eb7bd8f9b7956",
          "name": "Government of Alberta: U of A -> Telus -> Advanced Education",
          "description": "So I retraced some steps. I guess I'm admin. Neat. Already notified Ministry of Advanced Education, Government of Alberta Cybersecurity (not helpful). I don't have access to this account anymore (well, I haven't tried), but I did work my way back in an attempt to figure out why I could administrate the \"Honourable Ministry of Education\". \n\nUpdate on the alberta.ca domain: by malcore on 02.11.25 in references. **Need to add malcore IOCs** https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665da3e8886f5e4ecce",
          "modified": "2025-03-14T21:04:23.242000",
          "created": "2024-04-08T20:41:03.850000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/graph/embed/g4f693a77e33b425bba54132d3a641fcd8b78af74d8fc44528a643c4a264d582f?theme=dark",
            "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984/iocs",
            "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984",
            "https://www.alberta.ca/minister-of-advanced-education",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665782e1dfbf8ec2d3c",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665da3e8886f5e4ecce"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government",
            "Education",
            "Telecommunications",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 5,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 5137,
            "hostname": 3405,
            "domain": 1659,
            "URL": 2452,
            "FileHash-MD5": 576,
            "FileHash-SHA1": 567,
            "CIDR": 9,
            "email": 7,
            "CVE": 15
          },
          "indicator_count": 13827,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 132,
          "modified_text": "401 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6647908c09468f42bc1249f1",
          "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
          "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
          "modified": "2025-03-01T04:59:57.222000",
          "created": "2024-05-17T17:14:52.317000",
          "tags": [
            "false",
            "true",
            "visible",
            "application",
            "microsoft teams",
            "microsoft azure",
            "office",
            "service",
            "dynamics",
            "hidden",
            "android",
            "explorer",
            "write",
            "connector",
            "test",
            "sharepoint",
            "live",
            "meister",
            "tools",
            "desktop",
            "spark",
            "front",
            "enterprise",
            "designer",
            "atlas",
            "premium",
            "assistant",
            "allow",
            "azureadmyorg",
            "game",
            "verify",
            "microsoft power",
            "channelsurfcli",
            "mtd1",
            "file transfer",
            "magnus",
            "microsoft crm",
            "youth"
          ],
          "references": [
            "All - EnterpriseAppsList.csv",
            "AppRegistrationList.csv",
            "https://tria.ge/240517-vc7c1shc62/behavioral1",
            "https://tria.ge/240517-vdwb5shc71/behavioral1",
            "https://tria.ge/240517-vqxezaaa33/behavioral1",
            "https://tria.ge/240517-t9pc2ahb2t",
            "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
            "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
            "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
            "Thor Scan: S-I9VvMTB6cZU",
            "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
            "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
            "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
            "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
            "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
            "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
            "https://tria.ge/240521-q4s79agb25/static1",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
            "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
            "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
            "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
            "https://www.hudsonrock.com/search?domain=ualberta.ca",
            "https://www.criminalip.io/domain/report?scan_id=13798622",
            "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
            "https://urlscan.io/search/#ualberta.ca",
            "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
            "https://sitereport.netcraft.com/?url=http://ualberta.ca",
            "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
            "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
            "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
            "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Healthcare",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 7,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1703,
            "FileHash-SHA256": 90472,
            "URL": 99185,
            "domain": 82954,
            "hostname": 39041,
            "FileHash-SHA1": 1624,
            "email": 4658,
            "CVE": 12
          },
          "indicator_count": 319649,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "414 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66844266b18b359a3a385cf4",
          "name": "Alberta NDP",
          "description": "This pulse takes a peak into the Alberta NDP party and their current breach situation. The (original) purpose of this pulse was to further identify and characterize issues relating to the (still) ongoing UAlberta breach and to see if the Alberta NDP were impacted. Prepared this pulse to present to them as a component of it's relevancy to their own infrastructure (e.g. highlighting the privacy, safety, security implications for their party) as it was 2 months ago. Was told my contacts would be on vacation until September. It now seems during that waiting time much of the party and it's leaders have been breached/affected by similar malware & infostealers. Still waiting?",
          "modified": "2024-09-04T19:53:22.824000",
          "created": "2024-07-02T18:09:42.084000",
          "tags": [
            "Hacked",
            ""
          ],
          "references": [
            "https://www.virustotal.com/graph/embed/gc3d0a481dd64463a889ad9f206727d9d87db106da3c34deb922a2ce7837d6577?theme=dark",
            "https://www.virustotal.com/graph/embed/g99d61feda7554cba94972ae4110efe8acacfea236d6943d0bdc93dcbc7e9b60f?theme=dark",
            "https://www.virustotal.com/graph/embed/ga26f4bba58834344a271a36d59827ec2154f655df6324f939f674b0d49e1290a?theme=dark",
            "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06",
            "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/summary",
            "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/iocs",
            "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/graph",
            "https://www.virustotal.com/gui/collection/e49552b5297eb28f2ec7245429e50fb363823c4683606ddb61c1d014b2238a6e",
            "type,id 000d161246615fb8d5b30411c753420f82a881a9d7750639bbace67e1bb270a0 001155a72482c2ddd750b1e9c28633a7e13228e4e2b05f0ba585a395ac852b49 0014425cb6011c2086b6aeca5eee11368431356a68d173c2ff7ffef327c0ba86 0018686a02600f7da1a3f0981ce78bb6982480b14130a0cc2b8c8401bc1b8449 003bfd323f6366ac283b9f922d942d7c8f6070a2f2b919a719af7fc8e7c77995 00434aa911043b208854236a41c8e7a284185710ff67b52eea9f538f4151fa28 0063c0019a4ec47bc251753be3aca37c0d84699d34a99df83963364fe640c795 00651f483b685736596ebc95817b01c34382a4691b81701cc",
            "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984",
            "https://www.virustotal.com/gui/collection/4b0d82fda81972be3f9373edf863a3bcf426aafc9a53927eedc0b694554de33f",
            "https://viz.greynoise.io/analysis/52a90c2d-0774-46cd-bb66-79cb82c903fe - 07.03.24",
            "https://www.ipvoid.com/whois/",
            "https://leakix.net/search?scope=leak&q=alberta.ca",
            "https://intelx.io/?s=albertandp.ca",
            "http://ci-www.threatcrowd.org/domain.php?domain=albertandp.ca",
            "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fsites.google.com%2Fstudent.concordia.ab.ca%2Fcybersecuritybriefi%2Fhome&followup=https%3A%2F%2Fsites.google.com%2Fstudent.concordia.ab.ca%2Fcybersecuritybriefi%2Fhome&ifkv=AdF4I74DbXz0axIgI_8-2HKe5uTaiHcEn5GDXdTMvWumG7pqQExSEV6IUvXUJDoG9Ra0ZgbhrlrC&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1391668132%3A1721034538211512&ddm=0",
            ""
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government",
            "Telecommunications",
            "Healthcare",
            "Education",
            "Technology",
            "Hospitality",
            "Finance",
            "Manufacturing",
            "Retail"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 10030,
            "FileHash-MD5": 719,
            "FileHash-SHA1": 719,
            "FileHash-SHA256": 14832,
            "URL": 12538,
            "hostname": 10238,
            "CVE": 35,
            "email": 2,
            "CIDR": 847
          },
          "indicator_count": 49960,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "592 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "660b176a98b0c92ba5a962bc",
          "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise",
          "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.",
          "modified": "2024-09-04T05:01:56.993000",
          "created": "2024-04-01T20:22:02.851000",
          "tags": [
            "BEC"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
            "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
            "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
            "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
            "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 233,
            "FileHash-SHA1": 230,
            "FileHash-SHA256": 6703,
            "URL": 4450,
            "CIDR": 3,
            "domain": 6223,
            "hostname": 2863,
            "email": 7,
            "CVE": 53
          },
          "indicator_count": 20765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 129,
          "modified_text": "592 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6564fa9a3d90d1cd14928b16",
          "name": "Lumma \u2022 University of Alberta \"No Problems\" | T1036 - Masquerading",
          "description": "I was contacted on this forum re: University of Alberta issue. Based on research  www.ualberta.ca redirects. There hasn't been a research effort for redirect. I researched a spoofed website. After viewing senders request, my devices operating system changed, isn't recognized by any accounts, keyloggers.\nFound: Anonymizers, Redirector, Masquerading, Network RAT, Serious Social Engineering, Botnetwork Army, Stealers, Lumma and weirdly targeted  'Tsara Brashears' as a malicious link on a spoofed University in Canada, UCHealth Colorado links.",
          "modified": "2023-12-27T19:03:02.665000",
          "created": "2023-11-27T20:22:50.050000",
          "tags": [
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json url",
            "urls",
            "detection list",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "malicious site",
            "phishing site",
            "malicious url",
            "phishing",
            "riskware",
            "presenoker",
            "artemis",
            "agent",
            "unsafe",
            "opencandy",
            "ursnif",
            "wacatac",
            "team",
            "facebook",
            "runescape",
            "service",
            "downldr",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "installcore",
            "fareit",
            "secrisk",
            "exploit",
            "mimikatz",
            "sorano",
            "emotet",
            "genkryptik",
            "fuery",
            "dbatloader",
            "qakbot",
            "alexa",
            "malicious",
            "union",
            "lumma stealer",
            "fusioncore",
            "cleaner",
            "azorult",
            "bank",
            "blacknet rat",
            "stealer",
            "iframe",
            "trojanspy",
            "analysis",
            "united",
            "firehol",
            "proxy",
            "mail spammer",
            "downloader",
            "malware site",
            "meterpreter",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "unruy",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "generic",
            "dnspionage",
            "expirestue",
            "path",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "alberta",
            "university",
            "edmonton",
            "html info",
            "alberta meta",
            "tags",
            "trackers google",
            "tag manager",
            "gtmkr32",
            "blacklist",
            "low risk",
            "apache",
            "domain",
            "malware found",
            "unknown",
            "minimal low",
            "security risk",
            "medium high",
            "critical",
            "protect",
            "college",
            "mtis",
            "faculties",
            "research",
            "health",
            "a about",
            "news",
            "events",
            "sport",
            "life",
            "find",
            "story",
            "tools",
            "getprocaddress",
            "indicator",
            "prefetch8",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "pattern match",
            "file",
            "date",
            "factory",
            "hybrid",
            "general",
            "cookie",
            "click",
            "strings",
            "djin",
            "no data",
            "tag count",
            "sample",
            "samples",
            "netsky",
            "cobalt strike",
            "xrat",
            "fakealert",
            "raccoon",
            "redline stealer",
            "metastealer",
            "icedid",
            "quasar rat",
            "acint",
            "anonymizer",
            "blockchain",
            "social engineering",
            "read c",
            "search",
            "show",
            "medium",
            "entries",
            "whitelisted",
            "memcommit",
            "delete",
            "yara detections",
            "next",
            "dock",
            "write",
            "execution",
            "copy",
            "south carolina",
            "federal credit",
            "team proxy",
            "static engine",
            "covid19",
            "redirector",
            "suspic",
            "tue mar",
            "zbot",
            "size68b type",
            "count blacklist",
            "tag tag",
            "rejected sample",
            "icon",
            "analyzed",
            "hwp support",
            "falcon sandbox",
            "multi scan",
            "update",
            "view details",
            "upgrade",
            "blacklist https",
            "keyloggers"
          ],
          "references": [
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
            "uchealth.com",
            "http://michaela.young@uchealth.com",
            "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
            "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
            "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "MimiKatz",
              "display_name": "MimiKatz",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Network RAT",
              "display_name": "Network RAT",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Raccoon",
              "display_name": "Raccoon",
              "target": null
            },
            {
              "id": "OpenCandy",
              "display_name": "OpenCandy",
              "target": null
            },
            {
              "id": "Meterpreter",
              "display_name": "Meterpreter",
              "target": null
            },
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "TrojanX",
              "display_name": "TrojanX",
              "target": null
            },
            {
              "id": "BlackNET RAT",
              "display_name": "BlackNET RAT",
              "target": null
            },
            {
              "id": "Brontok",
              "display_name": "Brontok",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1588.004",
              "name": "Digital Certificates",
              "display_name": "T1588.004 - Digital Certificates"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            },
            {
              "id": "T1126",
              "name": "Network Share Connection Removal",
              "display_name": "T1126 - Network Share Connection Removal"
            },
            {
              "id": "T1136",
              "name": "Create Account",
              "display_name": "T1136 - Create Account"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1134.004",
              "name": "Parent PID Spoofing",
              "display_name": "T1134.004 - Parent PID Spoofing"
            }
          ],
          "industries": [
            "Education",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 320,
            "FileHash-SHA1": 172,
            "FileHash-SHA256": 4302,
            "URL": 8243,
            "CIDR": 1,
            "domain": 1742,
            "hostname": 2270,
            "CVE": 18,
            "SSLCertFingerprint": 3,
            "email": 4
          },
          "indicator_count": 17075,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "844 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
        "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
        "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://tria.ge/240521-q4s79agb25/static1",
        "All - EnterpriseAppsList.csv",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
        "uchealth.com",
        "https://urlscan.io/search/#ualberta.ca",
        "https://www.robtex.com/en/dns-lookup/ca/ualberta",
        "https://centralops.net/co/DomainDossier.aspx",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
        "https://www.merklemap.com/search?query=ualberta.ca&page=0",
        "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665782e1dfbf8ec2d3c",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://www.virustotal.com/gui/collection/e49552b5297eb28f2ec7245429e50fb363823c4683606ddb61c1d014b2238a6e",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://www.virustotal.com/graph/embed/gc3d0a481dd64463a889ad9f206727d9d87db106da3c34deb922a2ce7837d6577?theme=dark",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://www.virustotal.com/graph/embed/g4f693a77e33b425bba54132d3a641fcd8b78af74d8fc44528a643c4a264d582f?theme=dark",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://pulsedive.com/indicator/?indicator=ualberta.ca",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665da3e8886f5e4ecce",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
        "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
        "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
        "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984",
        "Thor Scan: S-I9VvMTB6cZU",
        "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://dnsdumpster.com/",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://who.is/whois/ualberta.ca",
        "https://pulsedive.com/ioc/ualberta.ca",
        "https://whois.easycounter.com/ualberta.ca",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate",
        "http://ci-www.threatcrowd.org/domain.php?domain=albertandp.ca",
        "type,id 000d161246615fb8d5b30411c753420f82a881a9d7750639bbace67e1bb270a0 001155a72482c2ddd750b1e9c28633a7e13228e4e2b05f0ba585a395ac852b49 0014425cb6011c2086b6aeca5eee11368431356a68d173c2ff7ffef327c0ba86 0018686a02600f7da1a3f0981ce78bb6982480b14130a0cc2b8c8401bc1b8449 003bfd323f6366ac283b9f922d942d7c8f6070a2f2b919a719af7fc8e7c77995 00434aa911043b208854236a41c8e7a284185710ff67b52eea9f538f4151fa28 0063c0019a4ec47bc251753be3aca37c0d84699d34a99df83963364fe640c795 00651f483b685736596ebc95817b01c34382a4691b81701cc",
        "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06",
        "https://www.filescan.io/uploads/67db2f67b93e688233ef36e9/reports/7e4e4377-5eb9-48a7-848d-bfdca4fb244c/ioc",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://intelx.io/?s=ualberta.ca",
        "https://centralops.net/co/",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
        "https://bgpview.io/asn/3359#whois",
        "http://michaela.young@uchealth.com",
        "https://www.criminalip.io/asset/search?query=ualberta.ca",
        "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fsites.google.com%2Fstudent.concordia.ab.ca%2Fcybersecuritybriefi%2Fhome&followup=https%3A%2F%2Fsites.google.com%2Fstudent.concordia.ab.ca%2Fcybersecuritybriefi%2Fhome&ifkv=AdF4I74DbXz0axIgI_8-2HKe5uTaiHcEn5GDXdTMvWumG7pqQExSEV6IUvXUJDoG9Ra0ZgbhrlrC&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1391668132%3A1721034538211512&ddm=0",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
        "https://web.archive.org/web/20250000000000*/ualberta.ca",
        "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
        "https://www.virustotal.com/gui/collection/4b0d82fda81972be3f9373edf863a3bcf426aafc9a53927eedc0b694554de33f",
        "https://whois.domaintools.com/ualberta.ca",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
        "https://www.whoxy.com/ualberta.ca",
        "https://viz.greynoise.io/query/AS3359",
        "https://intelx.io/?s=albertandp.ca",
        "https://www.virustotal.com/graph/embed/g99d61feda7554cba94972ae4110efe8acacfea236d6943d0bdc93dcbc7e9b60f?theme=dark",
        "https://viz.greynoise.io/analysis/52a90c2d-0774-46cd-bb66-79cb82c903fe - 07.03.24",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/iocs",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
        "https://viewdns.info/traceroute/?domain=ualberta.ca",
        "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43/67db93032dc368d2d80c3df1",
        "AppRegistrationList.csv",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/summary",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
        "https://bgp.he.net/dns/ualberta.ca",
        "https://viewdns.info/iphistory/?domain=ualberta.ca",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "https://www.alberta.ca/minister-of-advanced-education",
        "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/graph",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984/iocs",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://www.ipvoid.com/whois/",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://reverseip.domaintools.com/search/?q=ualberta.ca",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
        "https://viz.greynoise.io/analysis/5692e934-322f-48b9-bd9b-556e653ff5b6",
        "https://viewdns.info/portscan/?host=ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://www.virustotal.com/graph/embed/ga26f4bba58834344a271a36d59827ec2154f655df6324f939f674b0d49e1290a?theme=dark",
        "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
        "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
        "https://www.urlvoid.com/dns-records-lookup/",
        "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "https://leakix.net/search?scope=leak&q=alberta.ca",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43",
        "https://search.odin.io/hosts?query=ualberta.ca",
        "https://www.shodan.io/search?query=ualberta.ca",
        "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "dosdean@ualberta[.]ca // ciso@ualberta[.]ca"
          ],
          "malware_families": [
            "Meterpreter",
            "Trojanspy",
            "Qakbot",
            "Opencandy",
            "Unruy",
            "Brontok",
            "Emotet",
            "Blacknet rat",
            "Quasar rat",
            "Network rat",
            "Lumma stealer",
            "Raccoon",
            "Redline stealer",
            "Trojanx",
            "Mimikatz"
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Chemical",
            "Manufacturing",
            "Telecommunications",
            "Hospitality",
            "Media",
            "Retail",
            "Agriculture",
            "Education",
            "Technology",
            "Finance"
          ],
          "unique_indicators": 82740
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/facebook.com",
    "whois": "http://whois.domaintools.com/facebook.com",
    "domain": "facebook.com",
    "hostname": "www.facebook.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "68b60cdecf42fb532f2ceb12",
      "name": "U of A DataBreach Update - 11.13.25",
      "description": "Domain Analysis that serves as evidence of an on-going DataBreaches at the University of Alberta with associated references.\nAnalysis demonstrates abused critical infrastructure in the Province of Alberta stemming from UAlberta as detailed in this Pulse.",
      "modified": "2025-12-13T22:01:27.739000",
      "created": "2025-09-01T21:15:10.117000",
      "tags": [
        "as16509",
        "amazon02",
        "redirect",
        "tags",
        "as14618",
        "amazonaes",
        "search",
        "public",
        "search live",
        "api blog",
        "patch http",
        "please",
        "javascript",
        "url",
        "website",
        "web",
        "scanner",
        "analyze",
        "analyzer",
        "search api",
        "make sure",
        "domain",
        "and not",
        "page",
        "home search",
        "live api",
        "blog docs",
        "pricing login",
        "greynoise",
        "visualizer skip",
        "service status",
        "company blog",
        "us careers",
        "policies vpat",
        "slo privacy",
        "cookie patent",
        "copyright",
        "google privacy",
        "sandbox",
        "reputation",
        "phishing",
        "malware",
        "amazon web",
        "services",
        "warning icon",
        "share report",
        "systems",
        "cloudflare",
        "varnish",
        "nginx",
        "apache",
        "write",
        "virus",
        "trojan",
        "ransomware",
        "static",
        "analysis",
        "indicator of compromise",
        "ioc",
        "extraction",
        "emulation",
        "online",
        "submit",
        "sample",
        "download",
        "platform",
        "course",
        "program",
        "vxstream",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "UAlberta"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/iocs",
        "https://www.virustotal.com/gui/collection/081aaa3e4cc9594cebbd39781c156d337527737e7123481e44ca9de1b39852ee/summary",
        "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://viz.greynoise.io/ip/analysis/d90b0bd7-aaa1-4ea6-93c1-92bfd2d8f930",
        "https://urlquery.net/report/e9f9c430-fb2f-4166-8bfb-500339fdb9c0",
        "https://www.filescan.io/uploads/68b608d639a6221faa7935aa/reports/dd218cea-f81d-43ed-97fe-dd8c5aec52a3/ioc",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43",
        "https://viz.greynoise.io/query/AS3359",
        "https://www.virustotal.com/graph/embed/g4022b02acb3b46ddb4b24043845853d9f56a84d80b5849188fee79c90217d4ca?theme=dark",
        "http://ci-www.threatcrowd.org/domain.php?domain=ualberta.ca",
        "https://www.urlvoid.com/dns-records-lookup/",
        "https://www.shodan.io/search?query=ualberta.ca",
        "https://dnsdumpster.com/",
        "https://bgpview.io/asn/3359#whois",
        "https://centralops.net/co/",
        "https://app.netlas.io/domains/stats/?facets=domain&indices=&q=domain%3A%2A.ualberta.ca&size=1100",
        "09.10.25 - https://viz.greynoise.io/ip/analysis/df2c8c37-f8f2-4398-b709-7c716b03b697",
        "09.10.25 - https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://hybrid-analysis.com/sample/3b036b4b2b1d24e19238c6af7bbfaba465cf54cb2f9aab048002deddeafb7f43/680e723df123be6c63004290",
        "https://www.criminalip.io/asset/search?query=ualberta.ca",
        "09.20.25 - https://urlscan.io/search/#page.domain%3Aualberta.ca",
        "https://app.threat.zone/submission/c70698bf-881e-491a-a582-eee634b4bf73/url-analysis-report",
        "https://whois.domaintools.com/ualberta.ca",
        "https://research.domaintools.com/research/whois-history/search/?q=ualberta.ca",
        "https://viewdns.info/iphistory/?domain=ualberta.ca",
        "https://viewdns.info/portscan/?host=ualberta.ca",
        "https://whois.easycounter.com/ualberta.ca",
        "https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=ualberta.ca",
        "https://who.is/whois/ualberta.ca",
        "https://www.robtex.com/en/dns-lookup/ca/ualberta",
        "https://www.whoxy.com/ualberta.ca",
        "https://reverseip.domaintools.com/search/?q=ualberta.ca",
        "https://bgp.he.net/dns/ualberta.ca",
        "https://intelx.io/?s=ualberta.ca",
        "https://pulsedive.com/indicator/?indicator=ualberta.ca",
        "https://web.archive.org/web/20250000000000*/ualberta.ca",
        "https://crt.sh/?q=ualberta.ca&exclude=expired&group=none",
        "https://viewdns.info/traceroute/?domain=ualberta.ca",
        "https://centralops.net/co/DomainDossier.aspx",
        "https://search.odin.io/hosts?query=ualberta.ca",
        "https://www.merklemap.com/search?query=ualberta.ca&page=0"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 92,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9901,
        "domain": 790,
        "email": 982,
        "hostname": 10520,
        "FileHash-MD5": 550,
        "FileHash-SHA256": 1726,
        "FileHash-SHA1": 519,
        "SSLCertFingerprint": 64,
        "CIDR": 26,
        "CVE": 12
      },
      "indicator_count": 25090,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "127 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68198fe998b6e1fd28c5599c",
      "name": "The Open House that opens doors. Opublikuj Odpowiedz Saturday, October 15",
      "description": "The full text of the text-free version of Google Tag Manager, which was published on Wednesday, has been published online by Google's parent company, Alphabet, for the first time in its history.",
      "modified": "2025-06-05T00:04:02.181000",
      "created": "2025-05-06T04:28:25.685000",
      "tags": [
        "span",
        "script",
        "button",
        "university",
        "programs",
        "research",
        "alberta",
        "date",
        "back",
        "main menu",
        "union",
        "tools",
        "main",
        "canvas",
        "crisis",
        "footer",
        "iframe",
        "meta",
        "body",
        "school",
        "sport",
        "life",
        "energy",
        "contact",
        "small",
        "find",
        "null",
        "calendar"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 262,
        "domain": 11,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 1,
        "URL": 190,
        "hostname": 23
      },
      "indicator_count": 489,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 122,
      "modified_text": "318 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67db9be18168bc23126a0f17",
      "name": "Falcon Sandbox (Hybrid Analysis), FileScan[.]io & URLScan[.]io - UAlberta[.]ca domain analysis",
      "description": "Domain Analysis of hxxp://ualberta[.]ca w. Hybrid Analysis, Filescan, URLscan\n-Followed up w. analysis of previously submitted URLscan submissions w. an analysis by Greynoise[.]io (up to 03.19.25)\n-Greynoise yielded (from URLScan 120 Identified & 10 Unknowns) - the results classified as RIOTS appear to be confounded (potential abuse of Amazon Web Services in combination w. other cloud provider services.\n-It appears just visiting and/or touching this domain is - generally not recommended\n-Results from PulseDive -> Redirects to: https://www.ualberta[.]ca/en/index.html // SSL certificate found: ualberta[.]ca and 239 more. Edmonton, Canada, University of Alberta. dnsmaster@ualberta.ca\neasyDNS Technologies Inc. Amazon ALB, Amazon Cloudfront, Apache HTTP Server, Bootstrap, Coveo, Crazy Egg, Facebook Pixel, Font Awesome, Google Analytics, Google Font API, jQuery, Linkedin Insight Tag, Microsoft Clarity, Open Graph, TikTok Pixel, Twitter Ads",
      "modified": "2025-04-19T04:02:16.037000",
      "created": "2025-03-20T04:38:57.551000",
      "tags": [
        "as16509",
        "amazon02",
        "redirect",
        "as14618",
        "amazonaes",
        "search",
        "public",
        "home search",
        "live api",
        "blog docs",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "pcap processing",
        "ansi",
        "pcap",
        "gecko",
        "win64",
        "khtml",
        "windows nt",
        "brand",
        "prefetch8 ansi",
        "microsoft edge",
        "date",
        "cookie",
        "mozilla",
        "suspicious",
        "comspec",
        "window",
        "model",
        "hybrid",
        "accept",
        "hacked",
        "starfield",
        "encrypt",
        "close",
        "click",
        "twitter",
        "hosts",
        "service",
        "general",
        "path",
        "union",
        "dest",
        "strings",
        "contact"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43/67db93032dc368d2d80c3df1",
        "https://urlscan.io/search/#page.domain%3Awww.ualberta.ca",
        "https://www.filescan.io/uploads/67db2f67b93e688233ef36e9/reports/7e4e4377-5eb9-48a7-848d-bfdca4fb244c/ioc",
        "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43",
        "https://hybrid-analysis.com/sample/dea64c4ce5cd9b55fb634888e4c6530728e266c8cb6d2bf670a9fe9e3f712c43/67db93032dc368d2d80c3df1",
        "https://viz.greynoise.io/analysis/5692e934-322f-48b9-bd9b-556e653ff5b6",
        "https://pulsedive.com/ioc/ualberta.ca"
      ],
      "public": 1,
      "adversary": "dosdean@ualberta[.]ca // ciso@ualberta[.]ca",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [
        "Education",
        "Technology",
        "Government",
        "Agriculture",
        "Healthcare",
        "Chemical",
        "Finance",
        "Media"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 897,
        "domain": 37,
        "email": 34,
        "hostname": 396,
        "FileHash-MD5": 71,
        "FileHash-SHA1": 69,
        "FileHash-SHA256": 69,
        "SSLCertFingerprint": 23
      },
      "indicator_count": 1596,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "365 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6614565faf9eb7bd8f9b7956",
      "name": "Government of Alberta: U of A -> Telus -> Advanced Education",
      "description": "So I retraced some steps. I guess I'm admin. Neat. Already notified Ministry of Advanced Education, Government of Alberta Cybersecurity (not helpful). I don't have access to this account anymore (well, I haven't tried), but I did work my way back in an attempt to figure out why I could administrate the \"Honourable Ministry of Education\". \n\nUpdate on the alberta.ca domain: by malcore on 02.11.25 in references. **Need to add malcore IOCs** https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665da3e8886f5e4ecce",
      "modified": "2025-03-14T21:04:23.242000",
      "created": "2024-04-08T20:41:03.850000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/graph/embed/g4f693a77e33b425bba54132d3a641fcd8b78af74d8fc44528a643c4a264d582f?theme=dark",
        "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984/iocs",
        "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984",
        "https://www.alberta.ca/minister-of-advanced-education",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665782e1dfbf8ec2d3c",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/67ab2665da3e8886f5e4ecce"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Government",
        "Education",
        "Telecommunications",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 5,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 5137,
        "hostname": 3405,
        "domain": 1659,
        "URL": 2452,
        "FileHash-MD5": 576,
        "FileHash-SHA1": 567,
        "CIDR": 9,
        "email": 7,
        "CVE": 15
      },
      "indicator_count": 13827,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 132,
      "modified_text": "401 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6647908c09468f42bc1249f1",
      "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
      "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
      "modified": "2025-03-01T04:59:57.222000",
      "created": "2024-05-17T17:14:52.317000",
      "tags": [
        "false",
        "true",
        "visible",
        "application",
        "microsoft teams",
        "microsoft azure",
        "office",
        "service",
        "dynamics",
        "hidden",
        "android",
        "explorer",
        "write",
        "connector",
        "test",
        "sharepoint",
        "live",
        "meister",
        "tools",
        "desktop",
        "spark",
        "front",
        "enterprise",
        "designer",
        "atlas",
        "premium",
        "assistant",
        "allow",
        "azureadmyorg",
        "game",
        "verify",
        "microsoft power",
        "channelsurfcli",
        "mtd1",
        "file transfer",
        "magnus",
        "microsoft crm",
        "youth"
      ],
      "references": [
        "All - EnterpriseAppsList.csv",
        "AppRegistrationList.csv",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://urlscan.io/search/#ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Healthcare",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 7,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1703,
        "FileHash-SHA256": 90472,
        "URL": 99185,
        "domain": 82954,
        "hostname": 39041,
        "FileHash-SHA1": 1624,
        "email": 4658,
        "CVE": 12
      },
      "indicator_count": 319649,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "414 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66844266b18b359a3a385cf4",
      "name": "Alberta NDP",
      "description": "This pulse takes a peak into the Alberta NDP party and their current breach situation. The (original) purpose of this pulse was to further identify and characterize issues relating to the (still) ongoing UAlberta breach and to see if the Alberta NDP were impacted. Prepared this pulse to present to them as a component of it's relevancy to their own infrastructure (e.g. highlighting the privacy, safety, security implications for their party) as it was 2 months ago. Was told my contacts would be on vacation until September. It now seems during that waiting time much of the party and it's leaders have been breached/affected by similar malware & infostealers. Still waiting?",
      "modified": "2024-09-04T19:53:22.824000",
      "created": "2024-07-02T18:09:42.084000",
      "tags": [
        "Hacked",
        ""
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/gc3d0a481dd64463a889ad9f206727d9d87db106da3c34deb922a2ce7837d6577?theme=dark",
        "https://www.virustotal.com/graph/embed/g99d61feda7554cba94972ae4110efe8acacfea236d6943d0bdc93dcbc7e9b60f?theme=dark",
        "https://www.virustotal.com/graph/embed/ga26f4bba58834344a271a36d59827ec2154f655df6324f939f674b0d49e1290a?theme=dark",
        "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06",
        "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/summary",
        "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/iocs",
        "https://www.virustotal.com/gui/collection/40d6991f82d1a475ac48126d0fe7cd1481611146ae96cd496abf3f80955dda06/graph",
        "https://www.virustotal.com/gui/collection/e49552b5297eb28f2ec7245429e50fb363823c4683606ddb61c1d014b2238a6e",
        "type,id 000d161246615fb8d5b30411c753420f82a881a9d7750639bbace67e1bb270a0 001155a72482c2ddd750b1e9c28633a7e13228e4e2b05f0ba585a395ac852b49 0014425cb6011c2086b6aeca5eee11368431356a68d173c2ff7ffef327c0ba86 0018686a02600f7da1a3f0981ce78bb6982480b14130a0cc2b8c8401bc1b8449 003bfd323f6366ac283b9f922d942d7c8f6070a2f2b919a719af7fc8e7c77995 00434aa911043b208854236a41c8e7a284185710ff67b52eea9f538f4151fa28 0063c0019a4ec47bc251753be3aca37c0d84699d34a99df83963364fe640c795 00651f483b685736596ebc95817b01c34382a4691b81701cc",
        "https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984",
        "https://www.virustotal.com/gui/collection/4b0d82fda81972be3f9373edf863a3bcf426aafc9a53927eedc0b694554de33f",
        "https://viz.greynoise.io/analysis/52a90c2d-0774-46cd-bb66-79cb82c903fe - 07.03.24",
        "https://www.ipvoid.com/whois/",
        "https://leakix.net/search?scope=leak&q=alberta.ca",
        "https://intelx.io/?s=albertandp.ca",
        "http://ci-www.threatcrowd.org/domain.php?domain=albertandp.ca",
        "https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fsites.google.com%2Fstudent.concordia.ab.ca%2Fcybersecuritybriefi%2Fhome&followup=https%3A%2F%2Fsites.google.com%2Fstudent.concordia.ab.ca%2Fcybersecuritybriefi%2Fhome&ifkv=AdF4I74DbXz0axIgI_8-2HKe5uTaiHcEn5GDXdTMvWumG7pqQExSEV6IUvXUJDoG9Ra0ZgbhrlrC&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1391668132%3A1721034538211512&ddm=0",
        ""
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Government",
        "Telecommunications",
        "Healthcare",
        "Education",
        "Technology",
        "Hospitality",
        "Finance",
        "Manufacturing",
        "Retail"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 10030,
        "FileHash-MD5": 719,
        "FileHash-SHA1": 719,
        "FileHash-SHA256": 14832,
        "URL": 12538,
        "hostname": 10238,
        "CVE": 35,
        "email": 2,
        "CIDR": 847
      },
      "indicator_count": 49960,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "592 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "660b176a98b0c92ba5a962bc",
      "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise",
      "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.",
      "modified": "2024-09-04T05:01:56.993000",
      "created": "2024-04-01T20:22:02.851000",
      "tags": [
        "BEC"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
        "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
        "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
        "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
        "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 233,
        "FileHash-SHA1": 230,
        "FileHash-SHA256": 6703,
        "URL": 4450,
        "CIDR": 3,
        "domain": 6223,
        "hostname": 2863,
        "email": 7,
        "CVE": 53
      },
      "indicator_count": 20765,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 129,
      "modified_text": "592 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6564fa9a3d90d1cd14928b16",
      "name": "Lumma \u2022 University of Alberta \"No Problems\" | T1036 - Masquerading",
      "description": "I was contacted on this forum re: University of Alberta issue. Based on research  www.ualberta.ca redirects. There hasn't been a research effort for redirect. I researched a spoofed website. After viewing senders request, my devices operating system changed, isn't recognized by any accounts, keyloggers.\nFound: Anonymizers, Redirector, Masquerading, Network RAT, Serious Social Engineering, Botnetwork Army, Stealers, Lumma and weirdly targeted  'Tsara Brashears' as a malicious link on a spoofed University in Canada, UCHealth Colorado links.",
      "modified": "2023-12-27T19:03:02.665000",
      "created": "2023-11-27T20:22:50.050000",
      "tags": [
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json url",
        "urls",
        "detection list",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "malicious site",
        "phishing site",
        "malicious url",
        "phishing",
        "riskware",
        "presenoker",
        "artemis",
        "agent",
        "unsafe",
        "opencandy",
        "ursnif",
        "wacatac",
        "team",
        "facebook",
        "runescape",
        "service",
        "downldr",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "installcore",
        "fareit",
        "secrisk",
        "exploit",
        "mimikatz",
        "sorano",
        "emotet",
        "genkryptik",
        "fuery",
        "dbatloader",
        "qakbot",
        "alexa",
        "malicious",
        "union",
        "lumma stealer",
        "fusioncore",
        "cleaner",
        "azorult",
        "bank",
        "blacknet rat",
        "stealer",
        "iframe",
        "trojanspy",
        "analysis",
        "united",
        "firehol",
        "proxy",
        "mail spammer",
        "downloader",
        "malware site",
        "meterpreter",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "unruy",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "generic",
        "dnspionage",
        "expirestue",
        "path",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "alberta",
        "university",
        "edmonton",
        "html info",
        "alberta meta",
        "tags",
        "trackers google",
        "tag manager",
        "gtmkr32",
        "blacklist",
        "low risk",
        "apache",
        "domain",
        "malware found",
        "unknown",
        "minimal low",
        "security risk",
        "medium high",
        "critical",
        "protect",
        "college",
        "mtis",
        "faculties",
        "research",
        "health",
        "a about",
        "news",
        "events",
        "sport",
        "life",
        "find",
        "story",
        "tools",
        "getprocaddress",
        "indicator",
        "prefetch8",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "pattern match",
        "file",
        "date",
        "factory",
        "hybrid",
        "general",
        "cookie",
        "click",
        "strings",
        "djin",
        "no data",
        "tag count",
        "sample",
        "samples",
        "netsky",
        "cobalt strike",
        "xrat",
        "fakealert",
        "raccoon",
        "redline stealer",
        "metastealer",
        "icedid",
        "quasar rat",
        "acint",
        "anonymizer",
        "blockchain",
        "social engineering",
        "read c",
        "search",
        "show",
        "medium",
        "entries",
        "whitelisted",
        "memcommit",
        "delete",
        "yara detections",
        "next",
        "dock",
        "write",
        "execution",
        "copy",
        "south carolina",
        "federal credit",
        "team proxy",
        "static engine",
        "covid19",
        "redirector",
        "suspic",
        "tue mar",
        "zbot",
        "size68b type",
        "count blacklist",
        "tag tag",
        "rejected sample",
        "icon",
        "analyzed",
        "hwp support",
        "falcon sandbox",
        "multi scan",
        "update",
        "view details",
        "upgrade",
        "blacklist https",
        "keyloggers"
      ],
      "references": [
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
        "uchealth.com",
        "http://michaela.young@uchealth.com",
        "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
        "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
        "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "MimiKatz",
          "display_name": "MimiKatz",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "Network RAT",
          "display_name": "Network RAT",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Raccoon",
          "display_name": "Raccoon",
          "target": null
        },
        {
          "id": "OpenCandy",
          "display_name": "OpenCandy",
          "target": null
        },
        {
          "id": "Meterpreter",
          "display_name": "Meterpreter",
          "target": null
        },
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "TrojanX",
          "display_name": "TrojanX",
          "target": null
        },
        {
          "id": "BlackNET RAT",
          "display_name": "BlackNET RAT",
          "target": null
        },
        {
          "id": "Brontok",
          "display_name": "Brontok",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1588.004",
          "name": "Digital Certificates",
          "display_name": "T1588.004 - Digital Certificates"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        },
        {
          "id": "T1126",
          "name": "Network Share Connection Removal",
          "display_name": "T1126 - Network Share Connection Removal"
        },
        {
          "id": "T1136",
          "name": "Create Account",
          "display_name": "T1136 - Create Account"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1134.004",
          "name": "Parent PID Spoofing",
          "display_name": "T1134.004 - Parent PID Spoofing"
        }
      ],
      "industries": [
        "Education",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 83,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 320,
        "FileHash-SHA1": 172,
        "FileHash-SHA256": 4302,
        "URL": 8243,
        "CIDR": 1,
        "domain": 1742,
        "hostname": 2270,
        "CVE": 18,
        "SSLCertFingerprint": 3,
        "email": 4
      },
      "indicator_count": 17075,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "844 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.facebook.com/ualberta",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.facebook.com/ualberta",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642828.2764037
}