{
  "type": "Domain",
  "indicator": "microsoft-login.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/microsoft-login.com",
    "alexa": "http://www.alexa.com/siteinfo/microsoft-login.com",
    "indicator": "microsoft-login.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4157203540,
      "indicator": "microsoft-login.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6a03cc521e13c5d6d34555d0",
          "name": "Judgement Day. VirusTotal report                    for index.html",
          "description": "[Apple.com has sent a series of \"fl flushMessages\" to its servers, but what exactly is the data and what is it going to get out of the system and how does it feel?]",
          "modified": "2026-05-15T10:22:00.139000",
          "created": "2026-05-13T00:56:50.182000",
          "tags": [
            "darwin kernel",
            "version",
            "wed feb",
            "apfs4kobjs",
            "instagram",
            "mosaic",
            "free",
            "get http",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls https",
            "tls sni",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr13",
            "validity",
            "subject public",
            "key info",
            "performs dns",
            "https",
            "urls",
            "united",
            "mitre attack",
            "network info",
            "processes extra",
            "t1055 process",
            "layer protocol",
            "overview",
            "phishing",
            "defense evasion",
            "next",
            "default",
            "parent pid",
            "full path",
            "command line",
            "k netsvcs",
            "k localservice",
            "s w32time",
            "event provider",
            "device",
            "registry keys"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 132,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 6,
            "hostname": 364,
            "IPv4": 75,
            "URL": 574,
            "Mutex": 1,
            "FileHash-SHA256": 404
          },
          "indicator_count": 1599,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "19 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "693096c1cabeccbc6b3a5def",
          "name": "Phishing Domain Patterns - Brand Impersonation 2025",
          "description": "Common phishing domain patterns impersonating major brands. Detection patterns for brand protection.\n\nTARGETED BRANDS:\n- Microsoft/Office365\n- Google\n- Apple\n- Amazon\n- PayPal\n- Banking\n- Social Media\n\nMITRE ATT&CK: T1566.002, T1583.001\n\nDugganUSA Pattern Library",
          "modified": "2025-12-03T20:00:01.385000",
          "created": "2025-12-03T20:00:01.385000",
          "tags": [
            "phishing",
            "domain",
            "brand-impersonation",
            "microsoft",
            "google",
            "apple",
            "amazon",
            "paypal",
            "dugganusa"
          ],
          "references": [
            "https://www.dugganusa.com",
            "https://analytics.dugganusa.com/api/v1/stix-feed"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "pduggusa",
            "id": "371400",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 30
          },
          "indicator_count": 30,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 198,
          "modified_text": "181 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.dugganusa.com",
        "https://analytics.dugganusa.com/api/v1/stix-feed"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6a03cc521e13c5d6d34555d0",
      "name": "Judgement Day. VirusTotal report                    for index.html",
      "description": "[Apple.com has sent a series of \"fl flushMessages\" to its servers, but what exactly is the data and what is it going to get out of the system and how does it feel?]",
      "modified": "2026-05-15T10:22:00.139000",
      "created": "2026-05-13T00:56:50.182000",
      "tags": [
        "darwin kernel",
        "version",
        "wed feb",
        "apfs4kobjs",
        "instagram",
        "mosaic",
        "free",
        "get http",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls https",
        "tls sni",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr13",
        "validity",
        "subject public",
        "key info",
        "performs dns",
        "https",
        "urls",
        "united",
        "mitre attack",
        "network info",
        "processes extra",
        "t1055 process",
        "layer protocol",
        "overview",
        "phishing",
        "defense evasion",
        "next",
        "default",
        "parent pid",
        "full path",
        "command line",
        "k netsvcs",
        "k localservice",
        "s w32time",
        "event provider",
        "device",
        "registry keys"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 132,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 6,
        "hostname": 364,
        "IPv4": 75,
        "URL": 574,
        "Mutex": 1,
        "FileHash-SHA256": 404
      },
      "indicator_count": 1599,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "19 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "693096c1cabeccbc6b3a5def",
      "name": "Phishing Domain Patterns - Brand Impersonation 2025",
      "description": "Common phishing domain patterns impersonating major brands. Detection patterns for brand protection.\n\nTARGETED BRANDS:\n- Microsoft/Office365\n- Google\n- Apple\n- Amazon\n- PayPal\n- Banking\n- Social Media\n\nMITRE ATT&CK: T1566.002, T1583.001\n\nDugganUSA Pattern Library",
      "modified": "2025-12-03T20:00:01.385000",
      "created": "2025-12-03T20:00:01.385000",
      "tags": [
        "phishing",
        "domain",
        "brand-impersonation",
        "microsoft",
        "google",
        "apple",
        "amazon",
        "paypal",
        "dugganusa"
      ],
      "references": [
        "https://www.dugganusa.com",
        "https://analytics.dugganusa.com/api/v1/stix-feed"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "pduggusa",
        "id": "371400",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 30
      },
      "indicator_count": 30,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 198,
      "modified_text": "181 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "microsoft-login.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "microsoft-login.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780491367.7796297
}