{
  "type": "URL",
  "indicator": "https://freeddns.dynu.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://freeddns.dynu.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "majestic",
        "message": "Whitelisted domain dynu.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3923254247,
      "indicator": "https://freeddns.dynu.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69bb934d1670bf357565e5bc",
          "name": "HeartCrypt ioc's",
          "description": "",
          "modified": "2026-04-18T06:00:28.363000",
          "created": "2026-03-19T06:10:21.018000",
          "tags": [
            "unknown",
            "nxdomain",
            "a nxdomain",
            "united",
            "united kingdom",
            "as3269 telecom",
            "italy unknown",
            "as7489 hostus",
            "as2856",
            "germany unknown",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 201,
            "hostname": 237,
            "domain": 2
          },
          "indicator_count": 440,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "45 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692a86b454eea18b993a2078",
          "name": "DC RAT Injection | Endgame Systems | Lazarus Group related",
          "description": "Monitoring. MITRE ATT&CK (T1057) Monitored target/s. DNS requests. Property discovery \n\nRelated to Lazarus Groups expansion",
          "modified": "2025-12-29T03:02:56.986000",
          "created": "2025-11-29T05:37:56.021000",
          "tags": [
            "ukraine",
            "win32",
            "dynamicloader",
            "ssl cert",
            "write c",
            "asyncrat",
            "various rat",
            "dcrat",
            "write",
            "guard",
            "malware",
            "all ipv4",
            "ukraine asn",
            "dns resolutions",
            "domains top",
            "level",
            "read c",
            "memcommit",
            "user execution",
            "delete",
            "msie",
            "windows nt",
            "dock",
            "execution",
            "masking",
            "yara rule",
            "high",
            "windows",
            "msvisualcpp60",
            "process",
            "intel",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "access att",
            "t1566 phishing",
            "flag",
            "ukraine ukraine",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "dynu",
            "mitre att",
            "ck matrix",
            "ascii text",
            "pattern match",
            "network traffic",
            "t1071",
            "t1057",
            "general",
            "local",
            "path",
            "beginstring",
            "segoe ui",
            "null",
            "refresh",
            "body",
            "click",
            "strings",
            "error",
            "tools",
            "title",
            "look",
            "verify",
            "restart"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/64e591d43f920a5194806bba9da40e0344db5333cd773da4df4f27259222529d/692a7e373e637b291e0a0957",
            "Statutory Masking Enabled - a domain registrar is hiding the public contact information for a domains",
            "registrant in its WHOIS record, often due to regulations like GDPR or ICANN policies.",
            "MITRE ATT&CK (T1057) Monitoring Target/s. Can be reviewed in Hybrid-Analysis sample."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/AmsiTamper.B",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/AmsiTamper.B",
              "target": null
            },
            {
              "id": "Win.Trojan.DcRat-10039889-0",
              "display_name": "Win.Trojan.DcRat-10039889-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "TA0039",
              "name": "Remote Service Effects",
              "display_name": "TA0039 - Remote Service Effects"
            },
            {
              "id": "TA0038",
              "name": "Network Effects",
              "display_name": "TA0038 - Network Effects"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 482,
            "URL": 819,
            "FileHash-SHA256": 274,
            "domain": 102,
            "email": 1,
            "FileHash-MD5": 73,
            "FileHash-SHA1": 65,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 1817,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "155 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Statutory Masking Enabled - a domain registrar is hiding the public contact information for a domains",
        "https://hybrid-analysis.com/sample/64e591d43f920a5194806bba9da40e0344db5333cd773da4df4f27259222529d/692a7e373e637b291e0a0957",
        "registrant in its WHOIS record, often due to regulations like GDPR or ICANN policies.",
        "MITRE ATT&CK (T1057) Monitoring Target/s. Can be reviewed in Hybrid-Analysis sample."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Alf:heraklezeval:trojan:win32/amsitamper.b",
            "Win.trojan.dcrat-10039889-0"
          ],
          "industries": [],
          "unique_indicators": 2101
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/dynu.com",
    "whois": "http://whois.domaintools.com/dynu.com",
    "domain": "dynu.com",
    "hostname": "freeddns.dynu.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69bb934d1670bf357565e5bc",
      "name": "HeartCrypt ioc's",
      "description": "",
      "modified": "2026-04-18T06:00:28.363000",
      "created": "2026-03-19T06:10:21.018000",
      "tags": [
        "unknown",
        "nxdomain",
        "a nxdomain",
        "united",
        "united kingdom",
        "as3269 telecom",
        "italy unknown",
        "as7489 hostus",
        "as2856",
        "germany unknown",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 201,
        "hostname": 237,
        "domain": 2
      },
      "indicator_count": 440,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "45 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692a86b454eea18b993a2078",
      "name": "DC RAT Injection | Endgame Systems | Lazarus Group related",
      "description": "Monitoring. MITRE ATT&CK (T1057) Monitored target/s. DNS requests. Property discovery \n\nRelated to Lazarus Groups expansion",
      "modified": "2025-12-29T03:02:56.986000",
      "created": "2025-11-29T05:37:56.021000",
      "tags": [
        "ukraine",
        "win32",
        "dynamicloader",
        "ssl cert",
        "write c",
        "asyncrat",
        "various rat",
        "dcrat",
        "write",
        "guard",
        "malware",
        "all ipv4",
        "ukraine asn",
        "dns resolutions",
        "domains top",
        "level",
        "read c",
        "memcommit",
        "user execution",
        "delete",
        "msie",
        "windows nt",
        "dock",
        "execution",
        "masking",
        "yara rule",
        "high",
        "windows",
        "msvisualcpp60",
        "process",
        "intel",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "access att",
        "t1566 phishing",
        "flag",
        "ukraine ukraine",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "dynu",
        "mitre att",
        "ck matrix",
        "ascii text",
        "pattern match",
        "network traffic",
        "t1071",
        "t1057",
        "general",
        "local",
        "path",
        "beginstring",
        "segoe ui",
        "null",
        "refresh",
        "body",
        "click",
        "strings",
        "error",
        "tools",
        "title",
        "look",
        "verify",
        "restart"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/64e591d43f920a5194806bba9da40e0344db5333cd773da4df4f27259222529d/692a7e373e637b291e0a0957",
        "Statutory Masking Enabled - a domain registrar is hiding the public contact information for a domains",
        "registrant in its WHOIS record, often due to regulations like GDPR or ICANN policies.",
        "MITRE ATT&CK (T1057) Monitoring Target/s. Can be reviewed in Hybrid-Analysis sample."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/AmsiTamper.B",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/AmsiTamper.B",
          "target": null
        },
        {
          "id": "Win.Trojan.DcRat-10039889-0",
          "display_name": "Win.Trojan.DcRat-10039889-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "TA0039",
          "name": "Remote Service Effects",
          "display_name": "TA0039 - Remote Service Effects"
        },
        {
          "id": "TA0038",
          "name": "Network Effects",
          "display_name": "TA0038 - Network Effects"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 482,
        "URL": 819,
        "FileHash-SHA256": 274,
        "domain": 102,
        "email": 1,
        "FileHash-MD5": 73,
        "FileHash-SHA1": 65,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 1817,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "155 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://freeddns.dynu.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://freeddns.dynu.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780439233.6463246
}