{
  "type": "URL",
  "indicator": "https://monitoring.dev.coveo.cc/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://monitoring.dev.coveo.cc/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4097493084,
      "indicator": "https://monitoring.dev.coveo.cc/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "68858e8244c8db854e8947c1",
          "name": "Goodreads Malware",
          "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
          "modified": "2025-08-26T01:03:19.405000",
          "created": "2025-07-27T02:27:14.517000",
          "tags": [
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "united",
            "flag united",
            "present jun",
            "present may",
            "present apr",
            "search",
            "moved",
            "creation date",
            "record value",
            "date",
            "body",
            "meta",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "memcommit",
            "value1",
            "partnerid4146",
            "username",
            "gamesessionid",
            "port",
            "destination",
            "regsetvalueexa",
            "mozilla",
            "write",
            "persistence",
            "execution",
            "malware",
            "copy",
            "next",
            "process32nextw",
            "show",
            "entries",
            "module load",
            "t1129",
            "intel",
            "ms windows",
            "showing",
            "t1045",
            "win32",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "pattern match",
            "ascii text",
            "null",
            "error",
            "starfield",
            "click",
            "hybrid",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "smbds ipc",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "yara detections",
            "nrv2x",
            "upxoepplace"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 155,
            "hostname": 1237,
            "FileHash-SHA256": 1141,
            "domain": 574,
            "URL": 4593,
            "FileHash-SHA1": 139,
            "email": 1,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 7848,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "237 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687c95b12318dd62bdfbd29e",
          "name": "sorting \u2026",
          "description": "",
          "modified": "2025-08-19T06:05:20.676000",
          "created": "2025-07-20T07:07:29.508000",
          "tags": [
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "discovery att",
            "files",
            "domain",
            "passive dns",
            "urls",
            "files ip",
            "address",
            "location united",
            "asn as14618",
            "less whois",
            "registrar",
            "et trojan",
            "msie",
            "windows nt",
            "show",
            "search",
            "entries",
            "unknown",
            "ascii text",
            "medium",
            "delete",
            "copy",
            "virustotal",
            "write",
            "next",
            "trojandropper",
            "malware",
            "asn as16509",
            "read c",
            "port",
            "destination",
            "rgba",
            "memcommit",
            "dock",
            "execution",
            "default",
            "unicode",
            "crlf line",
            "united",
            "xport",
            "module load",
            "t1129",
            "icmp traffic",
            "high",
            "cmd c",
            "t1055",
            "http",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "america flag",
            "next associated",
            "showing",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "flag",
            "country",
            "markmonitor",
            "name server",
            "date",
            "contacted hosts",
            "process details",
            "extraction",
            "data upload",
            "extri",
            "include review",
            "exclude sugges",
            "typ hos",
            "ipv4",
            "data",
            "copy sha256",
            "copy sha1",
            "copy md5",
            "sha1",
            "sha256",
            "size",
            "beginstring",
            "segoe ui",
            "null",
            "type data",
            "refresh",
            "body",
            "span",
            "hybrid",
            "general",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1596,
            "hostname": 2143,
            "FileHash-MD5": 73,
            "FileHash-SHA1": 48,
            "FileHash-SHA256": 422,
            "URL": 5044
          },
          "indicator_count": 9326,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 17049
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/coveo.cc",
    "whois": "http://whois.domaintools.com/coveo.cc",
    "domain": "coveo.cc",
    "hostname": "monitoring.dev.coveo.cc"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "68858e8244c8db854e8947c1",
      "name": "Goodreads Malware",
      "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
      "modified": "2025-08-26T01:03:19.405000",
      "created": "2025-07-27T02:27:14.517000",
      "tags": [
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "united",
        "flag united",
        "present jun",
        "present may",
        "present apr",
        "search",
        "moved",
        "creation date",
        "record value",
        "date",
        "body",
        "meta",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "memcommit",
        "value1",
        "partnerid4146",
        "username",
        "gamesessionid",
        "port",
        "destination",
        "regsetvalueexa",
        "mozilla",
        "write",
        "persistence",
        "execution",
        "malware",
        "copy",
        "next",
        "process32nextw",
        "show",
        "entries",
        "module load",
        "t1129",
        "intel",
        "ms windows",
        "showing",
        "t1045",
        "win32",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "pattern match",
        "ascii text",
        "null",
        "error",
        "starfield",
        "click",
        "hybrid",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "smbds ipc",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "yara detections",
        "nrv2x",
        "upxoepplace"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 155,
        "hostname": 1237,
        "FileHash-SHA256": 1141,
        "domain": 574,
        "URL": 4593,
        "FileHash-SHA1": 139,
        "email": 1,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 7848,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "237 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687c95b12318dd62bdfbd29e",
      "name": "sorting \u2026",
      "description": "",
      "modified": "2025-08-19T06:05:20.676000",
      "created": "2025-07-20T07:07:29.508000",
      "tags": [
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "discovery att",
        "files",
        "domain",
        "passive dns",
        "urls",
        "files ip",
        "address",
        "location united",
        "asn as14618",
        "less whois",
        "registrar",
        "et trojan",
        "msie",
        "windows nt",
        "show",
        "search",
        "entries",
        "unknown",
        "ascii text",
        "medium",
        "delete",
        "copy",
        "virustotal",
        "write",
        "next",
        "trojandropper",
        "malware",
        "asn as16509",
        "read c",
        "port",
        "destination",
        "rgba",
        "memcommit",
        "dock",
        "execution",
        "default",
        "unicode",
        "crlf line",
        "united",
        "xport",
        "module load",
        "t1129",
        "icmp traffic",
        "high",
        "cmd c",
        "t1055",
        "http",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "america flag",
        "next associated",
        "showing",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "flag",
        "country",
        "markmonitor",
        "name server",
        "date",
        "contacted hosts",
        "process details",
        "extraction",
        "data upload",
        "extri",
        "include review",
        "exclude sugges",
        "typ hos",
        "ipv4",
        "data",
        "copy sha256",
        "copy sha1",
        "copy md5",
        "sha1",
        "sha256",
        "size",
        "beginstring",
        "segoe ui",
        "null",
        "type data",
        "refresh",
        "body",
        "span",
        "hybrid",
        "general",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1596,
        "hostname": 2143,
        "FileHash-MD5": 73,
        "FileHash-SHA1": 48,
        "FileHash-SHA256": 422,
        "URL": 5044
      },
      "indicator_count": 9326,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://monitoring.dev.coveo.cc/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://monitoring.dev.coveo.cc/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776651083.157839
}