{
  "type": "URL",
  "indicator": "https://rednails.store/delf",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://rednails.store/delf",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4143412368,
      "indicator": "https://rednails.store/delf",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69aa003c63c19b7be7671c65",
          "name": "re post by Q.Vashti cloned",
          "description": "",
          "modified": "2026-03-06T05:11:14.366000",
          "created": "2026-03-05T22:14:20.388000",
          "tags": [
            "filehashmd5",
            "filehashsha256",
            "ipv4",
            "filehashsha1",
            "domain",
            "types",
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "scan",
            "iocs",
            "learn more",
            "related pulses",
            "url https",
            "url http",
            "countrycn",
            "countrycn sep",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "xtblogblockid1",
            "pulses",
            "zdata0",
            "browserie",
            "browserver8",
            "defaultie",
            "ver1360122",
            "defaultch",
            "browserver11",
            "filesize",
            "browserid1",
            "qmark",
            "methodpost"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "68ffa35cd4eefffa0ffbeae1",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 381,
            "FileHash-SHA1": 367,
            "FileHash-SHA256": 767,
            "domain": 179,
            "URL": 1615,
            "hostname": 946,
            "CVE": 1
          },
          "indicator_count": 4256,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "44 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ffa35cd4eefffa0ffbeae1",
          "name": "Liar Liar! If this were your attorney; you\u2019d pay $$$ to get hacked and they\u2019d gain full CnC of your devices and disappear\u2026",
          "description": "Sample of FAKE attorneys  Liar Liar! If this were your attorney; you\u2019d pay $$$ to get hacked, they\u2019d gain full CnC of devices & disappear into the background , stealing from cloud, spying, etc..Mafia & Government ties. https://magento.hirecar.net/\n*Unix.Dropper.Mirai-7338044\n*Virus:Win32/Virut.BO\n*Trojan:Win32/Delf.EM\n*DDoS.XOR\n*Backdoor.Win32.Shiz.ivr, *Backdoor.Win32/Simda.gen!A\n*Alf:HeraklezEval:DoS:Linux/Xorddos!rfn\n*nUFS_html\n*Trojanspy:Win32/Nivdort.CB\n*Win32/Nystprac.A *Ramnit\n*Win32:Sality  *Upatre\n*Possible_QuasarRAT_Payload\nxor_0x15_xord_javascript\ninvalid_trailer_structure\n#fp539598-VBS/LoveLetter.BT\n*Trojanspy:Win32/Nivdort.CB\n*Alf:HeraklezEval:DoS:Linux/Xorddos!rfn\n*Trojan:Win64/Gapro\n\u201cMethodology_RareEquities_Tencent_Proxy\u201d\nvad_contains_network_strings\n*Trojan:Win32/Sisproc!gmb\n*TrojanDownloader:Win32/Upatre\n*PWS:MSIL/Grmasi.YA!MTB\n*Trojan:Win32/Danabot.G\n *Virus:Win32/Virut.EPO\n* Ramnit\nConventionEngine_Term_NewFolder",
          "modified": "2025-11-26T13:01:56.367000",
          "created": "2025-10-27T16:52:44.619000",
          "tags": [
            "filehashmd5",
            "filehashsha256",
            "ipv4",
            "filehashsha1",
            "domain",
            "types",
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "scan",
            "iocs",
            "learn more",
            "related pulses",
            "url https",
            "url http",
            "countrycn",
            "countrycn sep",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "xtblogblockid1",
            "pulses",
            "zdata0",
            "browserie",
            "browserver8",
            "defaultie",
            "ver1360122",
            "defaultch",
            "browserver11",
            "filesize",
            "browserid1",
            "qmark",
            "methodpost"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 381,
            "FileHash-SHA1": 367,
            "FileHash-SHA256": 767,
            "domain": 178,
            "URL": 1615,
            "hostname": 944
          },
          "indicator_count": 4252,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "144 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 4262
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/rednails.store",
    "whois": "http://whois.domaintools.com/rednails.store",
    "domain": "rednails.store",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69aa003c63c19b7be7671c65",
      "name": "re post by Q.Vashti cloned",
      "description": "",
      "modified": "2026-03-06T05:11:14.366000",
      "created": "2026-03-05T22:14:20.388000",
      "tags": [
        "filehashmd5",
        "filehashsha256",
        "ipv4",
        "filehashsha1",
        "domain",
        "types",
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "scan",
        "iocs",
        "learn more",
        "related pulses",
        "url https",
        "url http",
        "countrycn",
        "countrycn sep",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "xtblogblockid1",
        "pulses",
        "zdata0",
        "browserie",
        "browserver8",
        "defaultie",
        "ver1360122",
        "defaultch",
        "browserver11",
        "filesize",
        "browserid1",
        "qmark",
        "methodpost"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "68ffa35cd4eefffa0ffbeae1",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 381,
        "FileHash-SHA1": 367,
        "FileHash-SHA256": 767,
        "domain": 179,
        "URL": 1615,
        "hostname": 946,
        "CVE": 1
      },
      "indicator_count": 4256,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "44 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ffa35cd4eefffa0ffbeae1",
      "name": "Liar Liar! If this were your attorney; you\u2019d pay $$$ to get hacked and they\u2019d gain full CnC of your devices and disappear\u2026",
      "description": "Sample of FAKE attorneys  Liar Liar! If this were your attorney; you\u2019d pay $$$ to get hacked, they\u2019d gain full CnC of devices & disappear into the background , stealing from cloud, spying, etc..Mafia & Government ties. https://magento.hirecar.net/\n*Unix.Dropper.Mirai-7338044\n*Virus:Win32/Virut.BO\n*Trojan:Win32/Delf.EM\n*DDoS.XOR\n*Backdoor.Win32.Shiz.ivr, *Backdoor.Win32/Simda.gen!A\n*Alf:HeraklezEval:DoS:Linux/Xorddos!rfn\n*nUFS_html\n*Trojanspy:Win32/Nivdort.CB\n*Win32/Nystprac.A *Ramnit\n*Win32:Sality  *Upatre\n*Possible_QuasarRAT_Payload\nxor_0x15_xord_javascript\ninvalid_trailer_structure\n#fp539598-VBS/LoveLetter.BT\n*Trojanspy:Win32/Nivdort.CB\n*Alf:HeraklezEval:DoS:Linux/Xorddos!rfn\n*Trojan:Win64/Gapro\n\u201cMethodology_RareEquities_Tencent_Proxy\u201d\nvad_contains_network_strings\n*Trojan:Win32/Sisproc!gmb\n*TrojanDownloader:Win32/Upatre\n*PWS:MSIL/Grmasi.YA!MTB\n*Trojan:Win32/Danabot.G\n *Virus:Win32/Virut.EPO\n* Ramnit\nConventionEngine_Term_NewFolder",
      "modified": "2025-11-26T13:01:56.367000",
      "created": "2025-10-27T16:52:44.619000",
      "tags": [
        "filehashmd5",
        "filehashsha256",
        "ipv4",
        "filehashsha1",
        "domain",
        "types",
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "scan",
        "iocs",
        "learn more",
        "related pulses",
        "url https",
        "url http",
        "countrycn",
        "countrycn sep",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "xtblogblockid1",
        "pulses",
        "zdata0",
        "browserie",
        "browserver8",
        "defaultie",
        "ver1360122",
        "defaultch",
        "browserver11",
        "filesize",
        "browserid1",
        "qmark",
        "methodpost"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 381,
        "FileHash-SHA1": 367,
        "FileHash-SHA256": 767,
        "domain": 178,
        "URL": 1615,
        "hostname": 944
      },
      "indicator_count": 4252,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "144 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://rednails.store/delf",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://rednails.store/delf",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776622475.2679007
}