Report Overview
Visitedpublic
2026-02-15 07:02:52
Submit Tags
URL
ledgerrecovery.group/phase_2.php
Finishing URL
ledgerrecovery.group/phase_2.php
IP / ASN
37.77.150.227
Title
Ledger Live
Suspicious - Suspicious Javascript code
Detections
urlquery
2
Network Intrusion Detection
0
Threat Detection Systems
2
Host Summary
| Host | Rank | Registered | First Seen | Last Seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
ledgerrecovery.group 22 alert(s) on this Host | unknown | unknown | No data | No data | 9.4 kB | 1.7 MB | 37.77.150.227 |     |
Apache HTTP Server:2.4.52 (Web servers)
Apache is a free and open-source cross-platform web server software.Ubuntu (Operating systems)
Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.Bootstrap (UI frameworks)
Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.jQuery (JavaScript libraries)
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.Related reports
Threat Detection Systems
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| YARAhub by abuse.ch | ledgerrecovery.group/phase_2.php | malware | Detects file containing Telegram Bot API |
| DNS4EU | ledgerrecovery.group | malicious | Sinkholed |
Telegram Bot detected (1)
URL
ledgerrecovery.group/phase_2.php
IP / ASN
37.77.150.227
Token
8295719728:AAHAk8r-wrClpJ5fDsh8W3gN8bUwF7CcmHg
Bot Overview
User ID8295719728
Usernamedisconnectedtestingbot
First Nametesting grounds
Last NameN/A
Chat Info
Chat ID8127786253
Chat Typeprivate
TitleN/A
User Count2
Admins0
Pending Msgs1
JavaScript (8)
No JavaScripts
HTTP Transactions (20)
| URL | IP | Response | Size |
|---|