{
  "type": "URL",
  "indicator": "https://192.46.217.211",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://192.46.217.211",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4099724935,
      "indicator": "https://192.46.217.211",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "687f33a5ddf830e2f3e5acac",
          "name": "Trojan Dropper | Espionage | Keylogger affecting medical centers",
          "description": "PII and PHI at risk. Highest access spyware available infiltrates a small niche medical center. \ntrojandropper, keyloggers, advanced spyware, monitored rooms , mitre att, ||\nIDS: PROTOCOL-ICMP PATH MTU denial of service attempt \u2022  PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\n\u2022   https://foundry2sdbl.dvr.dn2.n-helix.com/\n\u2022 https://www.pegasustech.net/products/mobility-barcode-scanning/Data-collector-mobile-computer\n\n\u2022 \nrobloxlogger.com\n\u2022\n\nhttps://video.welnext.com\n\u2022\nhttps://app1.oceantg.com/sta40/views/personnelscreenview.aspx",
          "modified": "2025-08-21T06:00:20.607000",
          "created": "2025-07-22T06:45:57.499000",
          "tags": [
            "pegasus",
            "report spam",
            "gotham foundry",
            "espionage",
            "spinal cord",
            "injured created",
            "minutes ago",
            "strange",
            "foundry",
            "palantir",
            "alexa",
            "service",
            "url http",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "ipv4",
            "united",
            "germany",
            "singapore",
            "netherlands",
            "iran",
            "india",
            "search",
            "domain",
            "hostname",
            "filehashmd5",
            "filehashsha1",
            "extraction",
            "data upload",
            "sc type",
            "dren aeu",
            "extr source",
            "ur data",
            "include",
            "review exclude",
            "sugges",
            "mtu denial",
            "matches rule",
            "needed",
            "df bit",
            "unique rule",
            "catalog tree",
            "c0002 wininet",
            "ta0005 command",
            "control ta0011",
            "get http",
            "resolved ips",
            "dns resolutions",
            "cloudflare",
            "flag",
            "server",
            "date",
            "contacted hosts",
            "ip address",
            "process details",
            "t1158",
            "hidden",
            "t1031",
            "modify existing",
            "t1053",
            "taskjob",
            "t1060",
            "run keys",
            "startup",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "command",
            "found",
            "itre att",
            "show process",
            "prefetch8",
            "mitre att",
            "show technique",
            "ck matrix",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "april",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "entries",
            "unknown ns",
            "creation date",
            "record value",
            "showing",
            "gmt content",
            "accept encoding",
            "encrypt",
            "checked url",
            "hostname server",
            "response ip",
            "address google",
            "safe browsing",
            "present jan"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2628,
            "domain": 472,
            "hostname": 880,
            "FileHash-SHA256": 805,
            "FileHash-MD5": 151,
            "FileHash-SHA1": 128,
            "CIDR": 1,
            "SSLCertFingerprint": 3,
            "email": 1
          },
          "indicator_count": 5069,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687f209a7416c10d7465b8fc",
          "name": "Gotham Foundry | Pegasus Espionage for Spinal Cord Injured",
          "description": "It\u2019s hard to tell if the same group is spying on a single target or everyone; themis issue puts everyone at risk. It\u2019s quite an elaborate strategy to use for people who leave there homes only to go medical facility. Strange medical facility with overtly bad acries already spying on disabled . Everything including bathroom is monitored.\nPegasus, Foundry, Palantir, Alexa , Special Forces.\nColorado based \u2018Unnamed\u2019 care center.Going way too far!",
          "modified": "2025-08-21T05:03:19.254000",
          "created": "2025-07-22T05:24:42.261000",
          "tags": [
            "strange medical",
            "facility",
            "overt bad",
            "actors",
            "disabled",
            "rims http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashmd5",
            "entries",
            "medium",
            "high",
            "post https",
            "http",
            "ip address",
            "icmp traffic",
            "dns query",
            "http traffic",
            "http post",
            "windows nt",
            "copy",
            "malware",
            "checks",
            "virustotal api",
            "screenshots",
            "comments",
            "vendor finding",
            "notes avast",
            "win32",
            "alerts show",
            "search",
            "ck technique",
            "napolar",
            "service",
            "present jul",
            "error",
            "present mar",
            "files",
            "asn as26496",
            "whois registrar",
            "creation date",
            "pulses",
            "tags date",
            "otx telemetry",
            "spf record",
            "external",
            "present nov",
            "passive dns",
            "related nids",
            "urls",
            "files location",
            "india flag",
            "india related",
            "pulses otx",
            "google",
            "url http",
            "rims url",
            "pulse pulses",
            "united",
            "flag united",
            "get na",
            "microsoft word",
            "notes clamav",
            "ms defender",
            "mtb malware",
            "files matching",
            "number",
            "sample analysis",
            "hide samples",
            "mtb oct",
            "ipv4 add",
            "location india",
            "pune",
            "india asn",
            "win64",
            "trojan",
            "ipv4",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses ipv4",
            "source url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 52,
            "domain": 11,
            "hostname": 23,
            "FileHash-MD5": 117,
            "FileHash-SHA1": 115,
            "FileHash-SHA256": 115
          },
          "indicator_count": 433,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 5141
        }
      }
    },
    "false_positive": [],
    "alexa": "",
    "whois": "http://whois.domaintools.com/192.46.217.211",
    "domain": "Unavailable",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "687f33a5ddf830e2f3e5acac",
      "name": "Trojan Dropper | Espionage | Keylogger affecting medical centers",
      "description": "PII and PHI at risk. Highest access spyware available infiltrates a small niche medical center. \ntrojandropper, keyloggers, advanced spyware, monitored rooms , mitre att, ||\nIDS: PROTOCOL-ICMP PATH MTU denial of service attempt \u2022  PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\n\u2022   https://foundry2sdbl.dvr.dn2.n-helix.com/\n\u2022 https://www.pegasustech.net/products/mobility-barcode-scanning/Data-collector-mobile-computer\n\n\u2022 \nrobloxlogger.com\n\u2022\n\nhttps://video.welnext.com\n\u2022\nhttps://app1.oceantg.com/sta40/views/personnelscreenview.aspx",
      "modified": "2025-08-21T06:00:20.607000",
      "created": "2025-07-22T06:45:57.499000",
      "tags": [
        "pegasus",
        "report spam",
        "gotham foundry",
        "espionage",
        "spinal cord",
        "injured created",
        "minutes ago",
        "strange",
        "foundry",
        "palantir",
        "alexa",
        "service",
        "url http",
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "ipv4",
        "united",
        "germany",
        "singapore",
        "netherlands",
        "iran",
        "india",
        "search",
        "domain",
        "hostname",
        "filehashmd5",
        "filehashsha1",
        "extraction",
        "data upload",
        "sc type",
        "dren aeu",
        "extr source",
        "ur data",
        "include",
        "review exclude",
        "sugges",
        "mtu denial",
        "matches rule",
        "needed",
        "df bit",
        "unique rule",
        "catalog tree",
        "c0002 wininet",
        "ta0005 command",
        "control ta0011",
        "get http",
        "resolved ips",
        "dns resolutions",
        "cloudflare",
        "flag",
        "server",
        "date",
        "contacted hosts",
        "ip address",
        "process details",
        "t1158",
        "hidden",
        "t1031",
        "modify existing",
        "t1053",
        "taskjob",
        "t1060",
        "run keys",
        "startup",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "command",
        "found",
        "itre att",
        "show process",
        "prefetch8",
        "mitre att",
        "show technique",
        "ck matrix",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "april",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "entries",
        "unknown ns",
        "creation date",
        "record value",
        "showing",
        "gmt content",
        "accept encoding",
        "encrypt",
        "checked url",
        "hostname server",
        "response ip",
        "address google",
        "safe browsing",
        "present jan"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2628,
        "domain": 472,
        "hostname": 880,
        "FileHash-SHA256": 805,
        "FileHash-MD5": 151,
        "FileHash-SHA1": 128,
        "CIDR": 1,
        "SSLCertFingerprint": 3,
        "email": 1
      },
      "indicator_count": 5069,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687f209a7416c10d7465b8fc",
      "name": "Gotham Foundry | Pegasus Espionage for Spinal Cord Injured",
      "description": "It\u2019s hard to tell if the same group is spying on a single target or everyone; themis issue puts everyone at risk. It\u2019s quite an elaborate strategy to use for people who leave there homes only to go medical facility. Strange medical facility with overtly bad acries already spying on disabled . Everything including bathroom is monitored.\nPegasus, Foundry, Palantir, Alexa , Special Forces.\nColorado based \u2018Unnamed\u2019 care center.Going way too far!",
      "modified": "2025-08-21T05:03:19.254000",
      "created": "2025-07-22T05:24:42.261000",
      "tags": [
        "strange medical",
        "facility",
        "overt bad",
        "actors",
        "disabled",
        "rims http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashmd5",
        "entries",
        "medium",
        "high",
        "post https",
        "http",
        "ip address",
        "icmp traffic",
        "dns query",
        "http traffic",
        "http post",
        "windows nt",
        "copy",
        "malware",
        "checks",
        "virustotal api",
        "screenshots",
        "comments",
        "vendor finding",
        "notes avast",
        "win32",
        "alerts show",
        "search",
        "ck technique",
        "napolar",
        "service",
        "present jul",
        "error",
        "present mar",
        "files",
        "asn as26496",
        "whois registrar",
        "creation date",
        "pulses",
        "tags date",
        "otx telemetry",
        "spf record",
        "external",
        "present nov",
        "passive dns",
        "related nids",
        "urls",
        "files location",
        "india flag",
        "india related",
        "pulses otx",
        "google",
        "url http",
        "rims url",
        "pulse pulses",
        "united",
        "flag united",
        "get na",
        "microsoft word",
        "notes clamav",
        "ms defender",
        "mtb malware",
        "files matching",
        "number",
        "sample analysis",
        "hide samples",
        "mtb oct",
        "ipv4 add",
        "location india",
        "pune",
        "india asn",
        "win64",
        "trojan",
        "ipv4",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses ipv4",
        "source url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 52,
        "domain": 11,
        "hostname": 23,
        "FileHash-MD5": 117,
        "FileHash-SHA1": 115,
        "FileHash-SHA256": 115
      },
      "indicator_count": 433,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://192.46.217.211",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://192.46.217.211",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776699012.986095
}