{
  "type": "URL",
  "indicator": "https://mascoma.bank/privacy-policy/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mascoma.bank/privacy-policy/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4071323542,
      "indicator": "https://mascoma.bank/privacy-policy/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "6836497513b6637e7e6f39d2",
          "name": "Exploited Host",
          "description": "",
          "modified": "2025-06-26T22:03:25.914000",
          "created": "2025-05-27T23:23:33.814000",
          "tags": [
            "cname",
            "aaaa",
            "record type",
            "ttl value",
            "ascii text",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "sha256",
            "united",
            "pattern match",
            "mitre att",
            "date",
            "path",
            "encrypt",
            "starfield",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "4624",
            "records",
            "amazon02",
            "us ie",
            "dns ns",
            "dns a",
            "dns mx",
            "command decode",
            "ck id",
            "show technique",
            "ck matrix",
            "filehashsha1",
            "filehashsha256",
            "filehashmd5",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "showing",
            "entries",
            "pulses",
            "url https",
            "ipv4",
            "ccus asnas33070",
            "role",
            "value a",
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "version list"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 70,
            "FileHash-MD5": 225,
            "FileHash-SHA1": 232,
            "FileHash-SHA256": 1004,
            "domain": 138,
            "hostname": 74,
            "SSLCertFingerprint": 19,
            "email": 1
          },
          "indicator_count": 1763,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "683614d951f4e789950071b3",
          "name": "Malicious blockade",
          "description": "Malicious blockade, redirecting, bot activity affecting client-firm/entity interactions   (outreach organizations, legal, possibly educational\u2018 doubtful ) Botnet & monitoring\u2026my OTX profile is not working to it\u2019s full capacity. I am unable to do anything except upload and post in description.\nIPv4\n141.193.213.10\ncommand_and_control || IPv4\n142.250.150.26\nexploit_source || IPv4\n142.251.16.26\nexploit_source || IPv4\n142.251.163.26\nexploit_source ||\nhttps://crimestoppers.ab.ca\nphishing\t|| IPv4\n142.250.27.27 || Alerts - injection_inter_process\ncreates_largekey\nnetwork_bind\npersistence_autorun\npersistence_autorun_tasks\ncape_detected_threat\ninjection_process_hollowing\nantivm_generic_services\ndeletes_executed_files\ndeletes_self\ninjection_runpe\nIndirect_Command_Execution_Via_ConsoleWindowHost\npersistence_ads\nrecon_fingerprint\nsuspicious_command ||",
          "modified": "2025-06-26T19:05:21.983000",
          "created": "2025-05-27T19:39:05.470000",
          "tags": [
            "backdoor",
            "hstr",
            "checkin",
            "entries",
            "urls",
            "files",
            "location united",
            "america flag",
            "united",
            "america asn",
            "trojandropper",
            "ransom",
            "trojan",
            "cycbot",
            "hash avast",
            "avg clamav",
            "msdefender jan",
            "virtool",
            "cves all",
            "time",
            "alfper",
            "less see",
            "all av"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cycbot",
              "display_name": "Cycbot",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 24,
            "FileHash-MD5": 159,
            "FileHash-SHA1": 159,
            "FileHash-SHA256": 1440,
            "domain": 128,
            "hostname": 236,
            "email": 1
          },
          "indicator_count": 2147,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68361628539ed40883b8ee66",
          "name": "Cycbot | Prevents affected individuals from contacting intended entities ",
          "description": "",
          "modified": "2025-06-26T19:05:21.983000",
          "created": "2025-05-27T19:44:40.311000",
          "tags": [
            "backdoor",
            "hstr",
            "checkin",
            "entries",
            "urls",
            "files",
            "location united",
            "america flag",
            "united",
            "america asn",
            "trojandropper",
            "ransom",
            "trojan",
            "cycbot",
            "hash avast",
            "avg clamav",
            "msdefender jan",
            "virtool",
            "cves all",
            "time",
            "alfper",
            "less see",
            "all av"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cycbot",
              "display_name": "Cycbot",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "683614d951f4e789950071b3",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 24,
            "FileHash-MD5": 159,
            "FileHash-SHA1": 159,
            "FileHash-SHA256": 1440,
            "domain": 128,
            "hostname": 236,
            "email": 1
          },
          "indicator_count": 2147,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Cycbot"
          ],
          "industries": [],
          "unique_indicators": 3803
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/mascoma.bank",
    "whois": "http://whois.domaintools.com/mascoma.bank",
    "domain": "mascoma.bank",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "6836497513b6637e7e6f39d2",
      "name": "Exploited Host",
      "description": "",
      "modified": "2025-06-26T22:03:25.914000",
      "created": "2025-05-27T23:23:33.814000",
      "tags": [
        "cname",
        "aaaa",
        "record type",
        "ttl value",
        "ascii text",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "size",
        "sha256",
        "united",
        "pattern match",
        "mitre att",
        "date",
        "path",
        "encrypt",
        "starfield",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "4624",
        "records",
        "amazon02",
        "us ie",
        "dns ns",
        "dns a",
        "dns mx",
        "command decode",
        "ck id",
        "show technique",
        "ck matrix",
        "filehashsha1",
        "filehashsha256",
        "filehashmd5",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "showing",
        "entries",
        "pulses",
        "url https",
        "ipv4",
        "ccus asnas33070",
        "role",
        "value a",
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "version list"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 70,
        "FileHash-MD5": 225,
        "FileHash-SHA1": 232,
        "FileHash-SHA256": 1004,
        "domain": 138,
        "hostname": 74,
        "SSLCertFingerprint": 19,
        "email": 1
      },
      "indicator_count": 1763,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "683614d951f4e789950071b3",
      "name": "Malicious blockade",
      "description": "Malicious blockade, redirecting, bot activity affecting client-firm/entity interactions   (outreach organizations, legal, possibly educational\u2018 doubtful ) Botnet & monitoring\u2026my OTX profile is not working to it\u2019s full capacity. I am unable to do anything except upload and post in description.\nIPv4\n141.193.213.10\ncommand_and_control || IPv4\n142.250.150.26\nexploit_source || IPv4\n142.251.16.26\nexploit_source || IPv4\n142.251.163.26\nexploit_source ||\nhttps://crimestoppers.ab.ca\nphishing\t|| IPv4\n142.250.27.27 || Alerts - injection_inter_process\ncreates_largekey\nnetwork_bind\npersistence_autorun\npersistence_autorun_tasks\ncape_detected_threat\ninjection_process_hollowing\nantivm_generic_services\ndeletes_executed_files\ndeletes_self\ninjection_runpe\nIndirect_Command_Execution_Via_ConsoleWindowHost\npersistence_ads\nrecon_fingerprint\nsuspicious_command ||",
      "modified": "2025-06-26T19:05:21.983000",
      "created": "2025-05-27T19:39:05.470000",
      "tags": [
        "backdoor",
        "hstr",
        "checkin",
        "entries",
        "urls",
        "files",
        "location united",
        "america flag",
        "united",
        "america asn",
        "trojandropper",
        "ransom",
        "trojan",
        "cycbot",
        "hash avast",
        "avg clamav",
        "msdefender jan",
        "virtool",
        "cves all",
        "time",
        "alfper",
        "less see",
        "all av"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Cycbot",
          "display_name": "Cycbot",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 24,
        "FileHash-MD5": 159,
        "FileHash-SHA1": 159,
        "FileHash-SHA256": 1440,
        "domain": 128,
        "hostname": 236,
        "email": 1
      },
      "indicator_count": 2147,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68361628539ed40883b8ee66",
      "name": "Cycbot | Prevents affected individuals from contacting intended entities ",
      "description": "",
      "modified": "2025-06-26T19:05:21.983000",
      "created": "2025-05-27T19:44:40.311000",
      "tags": [
        "backdoor",
        "hstr",
        "checkin",
        "entries",
        "urls",
        "files",
        "location united",
        "america flag",
        "united",
        "america asn",
        "trojandropper",
        "ransom",
        "trojan",
        "cycbot",
        "hash avast",
        "avg clamav",
        "msdefender jan",
        "virtool",
        "cves all",
        "time",
        "alfper",
        "less see",
        "all av"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Cycbot",
          "display_name": "Cycbot",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "683614d951f4e789950071b3",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 24,
        "FileHash-MD5": 159,
        "FileHash-SHA1": 159,
        "FileHash-SHA256": 1440,
        "domain": 128,
        "hostname": 236,
        "email": 1
      },
      "indicator_count": 2147,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mascoma.bank/privacy-policy/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mascoma.bank/privacy-policy/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780320457.1651952
}