{
  "type": "URL",
  "indicator": "https://www1.nailsbydev.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www1.nailsbydev.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4099776773,
      "indicator": "https://www1.nailsbydev.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "687f33a5ddf830e2f3e5acac",
          "name": "Trojan Dropper | Espionage | Keylogger affecting medical centers",
          "description": "PII and PHI at risk. Highest access spyware available infiltrates a small niche medical center. \ntrojandropper, keyloggers, advanced spyware, monitored rooms , mitre att, ||\nIDS: PROTOCOL-ICMP PATH MTU denial of service attempt \u2022  PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\n\u2022   https://foundry2sdbl.dvr.dn2.n-helix.com/\n\u2022 https://www.pegasustech.net/products/mobility-barcode-scanning/Data-collector-mobile-computer\n\n\u2022 \nrobloxlogger.com\n\u2022\n\nhttps://video.welnext.com\n\u2022\nhttps://app1.oceantg.com/sta40/views/personnelscreenview.aspx",
          "modified": "2025-08-21T06:00:20.607000",
          "created": "2025-07-22T06:45:57.499000",
          "tags": [
            "pegasus",
            "report spam",
            "gotham foundry",
            "espionage",
            "spinal cord",
            "injured created",
            "minutes ago",
            "strange",
            "foundry",
            "palantir",
            "alexa",
            "service",
            "url http",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "ipv4",
            "united",
            "germany",
            "singapore",
            "netherlands",
            "iran",
            "india",
            "search",
            "domain",
            "hostname",
            "filehashmd5",
            "filehashsha1",
            "extraction",
            "data upload",
            "sc type",
            "dren aeu",
            "extr source",
            "ur data",
            "include",
            "review exclude",
            "sugges",
            "mtu denial",
            "matches rule",
            "needed",
            "df bit",
            "unique rule",
            "catalog tree",
            "c0002 wininet",
            "ta0005 command",
            "control ta0011",
            "get http",
            "resolved ips",
            "dns resolutions",
            "cloudflare",
            "flag",
            "server",
            "date",
            "contacted hosts",
            "ip address",
            "process details",
            "t1158",
            "hidden",
            "t1031",
            "modify existing",
            "t1053",
            "taskjob",
            "t1060",
            "run keys",
            "startup",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "command",
            "found",
            "itre att",
            "show process",
            "prefetch8",
            "mitre att",
            "show technique",
            "ck matrix",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "april",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "entries",
            "unknown ns",
            "creation date",
            "record value",
            "showing",
            "gmt content",
            "accept encoding",
            "encrypt",
            "checked url",
            "hostname server",
            "response ip",
            "address google",
            "safe browsing",
            "present jan"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2628,
            "domain": 472,
            "hostname": 880,
            "FileHash-SHA256": 805,
            "FileHash-MD5": 151,
            "FileHash-SHA1": 128,
            "CIDR": 1,
            "SSLCertFingerprint": 3,
            "email": 1
          },
          "indicator_count": 5069,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "241 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 5141
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/nailsbydev.com",
    "whois": "http://whois.domaintools.com/nailsbydev.com",
    "domain": "nailsbydev.com",
    "hostname": "www1.nailsbydev.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "687f33a5ddf830e2f3e5acac",
      "name": "Trojan Dropper | Espionage | Keylogger affecting medical centers",
      "description": "PII and PHI at risk. Highest access spyware available infiltrates a small niche medical center. \ntrojandropper, keyloggers, advanced spyware, monitored rooms , mitre att, ||\nIDS: PROTOCOL-ICMP PATH MTU denial of service attempt \u2022  PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\n\u2022   https://foundry2sdbl.dvr.dn2.n-helix.com/\n\u2022 https://www.pegasustech.net/products/mobility-barcode-scanning/Data-collector-mobile-computer\n\n\u2022 \nrobloxlogger.com\n\u2022\n\nhttps://video.welnext.com\n\u2022\nhttps://app1.oceantg.com/sta40/views/personnelscreenview.aspx",
      "modified": "2025-08-21T06:00:20.607000",
      "created": "2025-07-22T06:45:57.499000",
      "tags": [
        "pegasus",
        "report spam",
        "gotham foundry",
        "espionage",
        "spinal cord",
        "injured created",
        "minutes ago",
        "strange",
        "foundry",
        "palantir",
        "alexa",
        "service",
        "url http",
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "ipv4",
        "united",
        "germany",
        "singapore",
        "netherlands",
        "iran",
        "india",
        "search",
        "domain",
        "hostname",
        "filehashmd5",
        "filehashsha1",
        "extraction",
        "data upload",
        "sc type",
        "dren aeu",
        "extr source",
        "ur data",
        "include",
        "review exclude",
        "sugges",
        "mtu denial",
        "matches rule",
        "needed",
        "df bit",
        "unique rule",
        "catalog tree",
        "c0002 wininet",
        "ta0005 command",
        "control ta0011",
        "get http",
        "resolved ips",
        "dns resolutions",
        "cloudflare",
        "flag",
        "server",
        "date",
        "contacted hosts",
        "ip address",
        "process details",
        "t1158",
        "hidden",
        "t1031",
        "modify existing",
        "t1053",
        "taskjob",
        "t1060",
        "run keys",
        "startup",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "command",
        "found",
        "itre att",
        "show process",
        "prefetch8",
        "mitre att",
        "show technique",
        "ck matrix",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "april",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "entries",
        "unknown ns",
        "creation date",
        "record value",
        "showing",
        "gmt content",
        "accept encoding",
        "encrypt",
        "checked url",
        "hostname server",
        "response ip",
        "address google",
        "safe browsing",
        "present jan"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2628,
        "domain": 472,
        "hostname": 880,
        "FileHash-SHA256": 805,
        "FileHash-MD5": 151,
        "FileHash-SHA1": 128,
        "CIDR": 1,
        "SSLCertFingerprint": 3,
        "email": 1
      },
      "indicator_count": 5069,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "241 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www1.nailsbydev.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www1.nailsbydev.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641574.2069528
}