Is _ldap._tcp.dc._msdcs.workgroup safe?

The scan of _ldap._tcp.dc._msdcs.workgroup on 24 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.

What malware is associated with _ldap._tcp.dc._msdcs.workgroup?

8 analysed samples communicate with this URL, including Upatre, Zusy.

How was _ldap._tcp.dc._msdcs.workgroup checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

_ldap._tcp.dc._msdcs.workgroup - URL scan, 24 Aug 2026

MalwareAnalyzer by Cyble scanned _ldap._tcp.dc._msdcs.workgroup and returned a unknown verdict (score 0). 1 domain and 0 IPs were contacted. 8 malware samples communicate with this URL (Upatre, Zusy). This is a point-in-time observation from 24 Aug 2026; the page may have changed since.

Scan result

Verdict: unknown (score 0) · Confidence 3%
Scanned URL: https://_ldap._tcp.dc._msdcs.workgroup/
Domain: _ldap._tcp.dc._msdcs.workgroup
Scan tier: fast · observed 2026-08-24 05:46:41 UTC

Malware communicating with this URL (8)

These samples were observed contacting or being served from _ldap._tcp.dc._msdcs.workgroup. Each links to its full analysis.

Upatre - contacted · 9848be1181b746e1445bd9edddee3897 · first seen 2026-08-24
6ab308ac3b4b76697cf1b5d44a1e3eda9e23ee5dd44d7d7e069e9ba18d0c106b - contacted · 6ab308ac3b4b76697cf1b5d44a1e3eda · first seen 2026-08-24
3e7e2f3c36557031723d27140f6bf47156c95861e26a4b211555c875208799cf - contacted · 3e7e2f3c36557031723d27140f6bf471 · first seen 2026-08-23
ba44f77e1040c9bb227107ea7f006988dab5e8321dabda777a8b3eb93c820420 - contacted · ba44f77e1040c9bb227107ea7f006988 · first seen 2026-08-23
Zusy - contacted · 8bea203149b0ea2cd4e6ceb92bd67bc0 · first seen 2026-08-23
52df0d8c27c10120000d615586089c427ae636be9d17457eec7ba22a9ea214ef - contacted · 52df0d8c27c10120000d615586089c42 · first seen 2026-08-23
1809b71a007b18393c3ed23dc03c1e1aa554a3ebc5e620858c1086f7addf0bcb - contacted · 1809b71a007b18393c3ed23dc03c1e1a · first seen 2026-08-22
2829d845d7c8339fccca8bb14663a84caa859797666f05a1ecb04ae135af96dc - contacted · 2829d845d7c8339fccca8bb14663a84c · first seen 2026-08-22

Why this verdict

Target did not respond (DNS/connection failure or timeout); verdict from URL structure only

Observed indicators

_ldap._tcp.dc._msdcs.workgroup
https://_ldap._tcp.dc._msdcs.workgroup/

Other scans of _ldap._tcp.dc._msdcs.workgroup (4)

This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.

23 Aug 2026 - unknown
23 Aug 2026 - unknown
22 Aug 2026 - unknown
22 Aug 2026 - unknown

Questions about _ldap._tcp.dc._msdcs.workgroup

Is _ldap._tcp.dc._msdcs.workgroup safe?: The scan of _ldap._tcp.dc._msdcs.workgroup on 24 Aug 2026 reached no verdict either way (score 0). Too little was captured to judge it, which is an unknown rather than a pass.
What malware is associated with _ldap._tcp.dc._msdcs.workgroup?: 8 analysed samples communicate with this URL, including Upatre, Zusy.
How was _ldap._tcp.dc._msdcs.workgroup checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the fast tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of _ldap._tcp.dc._msdcs.workgroup

Scanned on MalwareAnalyzer by Cyble · Open interactive scan