Zvelo CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Zvelo PhishBlocklist

The Zvelo PhishBlocklist feed ingests phishing threats from Zvelo, that are enriched with additional metadata attributes.

GET https://api.zvelo.io/v1/phish

{
    "_meta": {
        "version": "1",
        "request_id": "2RHnGMyFWZJla85CRRigTAxdvMb",
        "generated_at": "2023-06-16T11:42:57.666041272Z",
        "requested_query": ""
    },
    "_response_part": {
        "page_no": 1,
        "num_pages": 2
    },
    "phish_info": {
        "phish": [
            {
                "ip_info": [
                    {
                        "ip": "2606:4700::6812:375"
                    },
                    {
                        "ip": "104.18.3.117"
                    }
                ],
                "url": "http://uspssitechange.com/",
                "discovered_date": "2023-06-16T11:12:49Z",
                "brand": "usps",
                "confidence_level": 80,
                "last_active_date": "2023-06-16T11:12:49Z",
                "status": "inactive",
                "last_verified_date": "2023-06-16T11:38:47.625155Z"
            }
        ]
    }
}

ThreatQuotient provides the following default mapping for this feed:

Zvelo Malicious Detailed Detection

The Zvelo Malicious Detailed Detection feed ingests malicious threat intelligence data from Zvelo, that is enriched with additional metadata attributes.

GET https://api.zvelo.io/v1/malicious

{
    "_meta": {
        "version": "1",
        "request_id": "2RQLffZwjb3WIPVmNUlhWecTHue",
        "generated_at": "2023-06-19T12:24:22.717062214Z",
        "requested_query": ""
    },
    "_response_part": {
        "page_no": 0,
        "num_pages": 1
    },
    "malicious_info": {
      "malicious": [
            {
                "ip_info": [
                    {
                        "ip": "117.213.42.81"
                    }
                ],
                "url": "http://117.213.42.81/Mozi.m/",
                "discovered_date": "2023-06-19T11:40:28Z",
                "confidence_level": 100,
                "last_active_date": "2023-06-19T11:40:28Z",
                "status": "active",
                "last_verified_date": "2023-06-19T11:40:28.558398Z"
            }
        ]
    }
}

ThreatQuotient provides the following default mapping for this feed:

Zvelo Threats

The Zvelo Threats feed ingests threats (IOCs) from Zvelo's API. These IOCs may be phishing URLs, C2 servers, or other types of threats.

GET https://api.zvelo.io/v1/threat

{
  "_meta": {
    "version": "1",
    "request_id": "2VGItRIlDpUxCicOiWhCCXxGZD1",
    "generated_at": "2023-09-11T18:16:44.427844289Z",
    "requested_query": ""
  },
  "_response_part": {
    "page_no": 0,
    "num_pages": 1
  },
  "threat_info": {
    "threat": [
      {
        "id": "bb5793b2-25dd-436b-b3b8-9c87836da1c7",
        "ioc": "39.105.50.248:443",
        "ioc_type": "ip",
        "threat_type": "command and control",
        "malware_family": "covenant",
        "ip_info": [
          {
            "ip": "39.105.50.248"
          }
        ],
        "discovered_date": "2022-08-04T09:02:19Z",
        "confidence_level": 100,
        "last_active_date": "2023-09-11T05:07:24Z",
        "status": "active",
        "last_verified_date": "2023-09-11T05:07:24Z",
        "updated_at": "2023-09-11T05:08:57.248228Z",
        "action": "u"
      }
    ]
  }
}

ThreatQuotient provides the following default mapping for this feed:

PDF Guides