{"report_id":"652f3897-bf82-48d8-a2c1-a54848a0080d","version":6,"status":"done","tags":["suspicious","telegram_bot"],"date":"2026-02-15T07:02:52Z","url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":0,"asn":0,"as":"","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"title":"Ledger Live","dom":{"size":182074,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text","md5":"c7da5e595ff60f2bc57a7c45e87f8057","sha1":"d7b770bb4c28ed4bf4363efd6d3f78112b8e351a","sha256":"eb53595e7e83c9891c3d2b112eed6781f1c51bdf228a96606fd181e9cb1fcdc6","sha512":"fc053b3318b2615bd549e49e0dac767dadcf8ae959230195b7eb1dbe3f5b9a5c9461f866dab37e1506d2a56b8b52eba4bd86512ac553c5db6b959ce2cddcc0c3","ssdeep":"384:6PA2FTfOM+QKAcBf+Z8iZJ5Ni0iB3J5Xi0iLvavVCJ5mi0i6ZCqWPzhPojQdfNjr:8ASTCjlwzP58pB55SpW+53pWMPHH","tlshash":"c704ca62b2a75bbd633337142b6e81227e51534f93c1c961360c7ce06f9ee60c2b5b66","dom_hash":"domhash41f3bdc7548e72e833789aef6c6ba401","first_seen":"2026-02-15T07:02:59.503991Z","last_seen":"2026-02-15T07:02:59.503991Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":0,"asn":0,"as":"","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-03-22T07:02:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-02-15","alert":"Detects file containing Telegram Bot API","trigger":"ledgerrecovery.group/phase_2.php","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null},{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"summary":[{"fqdn":"ledgerrecovery.group","ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":22,"request_count":20,"received_data":1693120,"sent_data":9445,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":[{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"md5":"7161c978f290a55ad50a4378dfb99fa2","sha1":"978fbd75555744efa19d1b19b54f7c5d17c03f78","sha256":"420e920fd45c6ef2140cb929f0c4001549a27bfa8ce57fb844effdfaa07007d0","sha512":"598c5d978e268825b51fd9a325230f9747373a29ff89f16b068ad75b9641f3c83feb84b4543547c249af0057a6288a6e51e65e5ab14409d4f814ffdb065323f2","size":12595,"token":"8295719728:AAHAk8r-wrClpJ5fDsh8W3gN8bUwF7CcmHg","is_revoked":false,"bot":{"token":"8295719728:AAHAk8r-wrClpJ5fDsh8W3gN8bUwF7CcmHg","user_id":"8295719728","username":"disconnectedtestingbot","first_name":"testing grounds","last_name":"","chat":{"chat_id":"8127786253","title":"","type":"private","bot_is":"member","total_users":2,"active_members":null,"admins":null},"pending_messages":1}}],"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"1a6416df97fbbe3efa02bdb0114ac96d","sha1":"ab755ff3f022d21c473233490c226d3a876604f8","sha256":"e56be4b958b5b68fdf7645a59bb9cbf45f72b5606a9de45e1c003309238d9e67","sha512":"4f5cbc1c1973d6e98094792b3562c0b8bd1b1b947704a39b5d82c6cc44d31431c1145d6ab5fe0e0fcbce8307af045d6affb0a312a510b0e690a4cbab40265d2b","ssdeep":"","tlshash":"c7f02b1cb6b714264237b86e174f620d31f550173818cc433a4c4a984fa2c2859f3d6d","size":581,"data":"","first_seen":"2026-02-15T07:02:59.534764Z","last_seen":"2026-02-15T07:02:59.534764Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"e2e53266f03cc2be1fc43c8eec5f75b9","sha1":"4130050a6c68d6e90f071359c62875e8b4ee956c","sha256":"9c4d348e3042351e85552e0311e5889e4a304567e86f1005446e31d7fd789941","sha512":"712060910da81de0d02d4e920baa57506883e62fc558c250810ec66332b1664dc6c512ce06757412a9e409297ef393a0806ea7b95b12dc13b3c76d4ee161cdd4","ssdeep":"","tlshash":"1ff0ab2df0f2115000bb74392e2bc8843d33763f620acf08746d1ed05f9ec95e0a2a25","size":595,"data":"","first_seen":"2026-02-15T07:02:59.536758Z","last_seen":"2026-02-15T07:02:59.536758Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"2a64194347567b6e5afc8b70b9eb96b2","sha1":"107a341a08ac1529446eed850f4174d70e96d5fd","sha256":"e1ef36a098b1636284803d3c7da2873dd9d853690972ce3895d087c0e25c8354","sha512":"e37fe8f3d4ad878d1998d96d3612c55aa5ff1e9158a53e5422719610fa9544ad1773b7c60d7db386aaca6e9c1a5ba5e671b05b1c64436e677e1923770319d225","ssdeep":"96:65qaAzGUnsIMUkdshEbY+KRGSivV5XbysKCsGs0F5CyiQA:hZpnsBkRGSivtKVZu5CyiQA","tlshash":"39d1fd15daa60c650577b418977b220a68a2852f7d14fd043b8d65ec2f3c21ec2f5efe","size":6592,"data":"","first_seen":"2026-02-15T07:02:59.538841Z","last_seen":"2026-02-15T07:02:59.538841Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"8ec147b046d397e8cf24a948b5146c9c","sha1":"b1418d7902ee7ffa0ca485db325ab84b40003614","sha256":"6f58b502c40c8cff265cc234ce87b4717b6c9d34811589cd653db418b5b90cf6","sha512":"3701bd107f7c6549f9bd77fdddbc02520ba94dcd4a0fc10c35c780cfda7de97df94270e5723864dfe0371fd218e7ca1a1de5472504d745f51ba67c5b78323a6b","ssdeep":"384:nhPojQdfNjfjYjtjWjzjcjxjzjyjpjgjnjmjdjOvNjbjqj6jBjsjNjOjM:V","tlshash":"8fc39062a6575bbda3323b101b6e8126b921234f53c5c975360cbce16f9fa60c3f4b16","size":118762,"data":"","first_seen":"2026-02-15T07:02:59.540738Z","last_seen":"2026-02-15T07:02:59.540738Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/bootstrap/jquery/jquery.min.js","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"2f772fed444d5489079f275bd01e26cc","sha1":"a8927ac2830b2fdd4a729eb0eb7f80923539ceb9","sha256":"2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a","sha512":"81f3b4d35aaa98af19a4d31ee5399d49e0f70ce52aadefffbf42c6c4489d9d50a49450eec8e9139a009da82b57bf677665a926d5ae913dfc4c74baeec186c422","ssdeep":"1536:jTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPmw:jgZm0H5HO5+gCKWZyPmHQ47GKc","tlshash":"8f8319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","size":88145,"data":"","first_seen":"2023-03-07T01:02:42Z","last_seen":"2026-08-13T22:17:29.359611Z","times_seen":7436,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"3562f18741e1d2c5817321238f240f28","sha1":"f9a2e6427d47e7ee6d876912ff50d9ed737c5d3b","sha256":"62d2a9ebaa38953928e0fdd75be27a4ed1e5947e99edc3c0efb87c433ad0af24","sha512":"b6e16fc6b0696f463d93eba57cbf4b516d094893605002c412395d5fe79c3cbc3bdc43aafad5e1a99fffb57a7fe85657baf80e05b16e2b2b8800c08f143a9f29","ssdeep":"","tlshash":"8fb0112aa0aa2802a0332228aebb003028a2200ba0288e803e0c08b20fc8020000c808","size":115,"data":"","first_seen":"2026-02-15T07:02:59.543126Z","last_seen":"2026-02-15T07:02:59.543126Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"c42bfde0447cf82e1db686c3d5e028ec","sha1":"44aece2cab63ff274a70c7c2cf9ea49cc18955c3","sha256":"d52f4bb00ea021787c12bf11fa5cd24fb823b4553d140230bab0b29d83c076bb","sha512":"35146f391c5620fdd25b1eeef94e612f2706ade1b9bbe40287663048c3e9e4258e42da2721d59971ec35b491c4235a9003e846f58de4916d7ae27b2bfe3de7e7","ssdeep":"","tlshash":"7631cc2d09e1402df607387faf6a52983ca4554f7300ae083bad737a5f61c7421f5ea9","size":1563,"data":"","first_seen":"2026-02-15T07:02:59.545029Z","last_seen":"2026-02-15T07:02:59.545029Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"7161c978f290a55ad50a4378dfb99fa2","sha1":"978fbd75555744efa19d1b19b54f7c5d17c03f78","sha256":"420e920fd45c6ef2140cb929f0c4001549a27bfa8ce57fb844effdfaa07007d0","sha512":"598c5d978e268825b51fd9a325230f9747373a29ff89f16b068ad75b9641f3c83feb84b4543547c249af0057a6288a6e51e65e5ab14409d4f814ffdb065323f2","ssdeep":"96:YeTMohYIiAcvXrbHX7bcJ1dxZNFOSdebMohYIixaLeUoMohYIiyg:YLoGY7noGJitBoGKg","tlshash":"01423841dd63299c107f931ab3c9723967c10b07a4c4d833768d18ea9f2cea696647fe","size":12595,"data":"","first_seen":"2026-02-15T07:02:59.546976Z","last_seen":"2026-02-15T07:02:59.546976Z","times_seen":1,"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-02-15","alert":"Detects file containing Telegram Bot API","trigger":"ledgerrecovery.group/phase_2.php","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}}],"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ledgerrecovery.group/css/2.css","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.679Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /css/2.css HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nLast-Modified: Wed, 11 Feb 2026 17:55:25 GMT\r\nETag: \"3f9b0-64a9013a4b01f-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nTransfer-Encoding: chunked\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":260528,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (50413), with CRLF line terminators","md5":"16b76c535e3c4a5b284d2077c4963c60","sha1":"c9c3e7ee21fe247637ce15994d938d896cdd9729","sha256":"2f40ccb3cc1f8057afe8a6394ee979a8ac1424c25951a2d79a5dc08d446c6325","sha512":"e8e8f5ff92b227b51948ab69e2e6c2ebc2dbe9ea799da70fc2b79d038dc3edaa60b123f10693dbd0f9ed13798fe06f0591ec4263450c181d44a0d95778a97209","ssdeep":"3072:bI/V7Z1Ym8t6SQTn9V7Z1Ym8t6SQTnAV7Z1Ym8t6SQTnTV7Z1Ym8t6SQTnO:cam86S6nsm86S6nnm86S6nem86S6nO","tlshash":"a644be519a008803fb79437d9f92ea24e9c9952bfad21c9a7a4cd0858ff7c6015b5fcc","first_seen":"2026-02-15T07:02:59.510584Z","last_seen":"2026-02-15T07:02:59.510584Z","times_seen":1,"resource_available":false,"data":null}},"time_used":245,"timings":{"blocked":43,"dns":3,"connect":29,"send":0,"wait":31,"receive":88,"ssl":42},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/mfkNbEskGSwj.svg","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.682Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/mfkNbEskGSwj.svg HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":219,"timings":{"blocked":188,"dns":0,"connect":0,"send":0,"wait":31,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/download.png","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.686Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/download.png HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":215,"timings":{"blocked":154,"dns":0,"connect":0,"send":0,"wait":61,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/WZ0i3ciKJp19.png","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.702Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/WZ0i3ciKJp19.png HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":223,"timings":{"blocked":181,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/main.js.download","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.966Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/main.js.download HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=96\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/download1.png","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.697Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/download1.png HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":403,"timings":{"blocked":144,"dns":1,"connect":61,"send":0,"wait":59,"receive":1,"ssl":61},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/8Sy1Q1E1EfZN.png","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.703Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/8Sy1Q1E1EfZN.png HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":179,"timings":{"blocked":137,"dns":0,"connect":0,"send":0,"wait":42,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/images/ledger_black_92.png","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.705Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /images/ledger_black_92.png HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nLast-Modified: Wed, 11 Feb 2026 17:55:32 GMT\r\nETag: \"1d7-64a901409ff3a\"\r\nAccept-Ranges: bytes\r\nContent-Length: 471\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":471,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 96 x 32, 8-bit gray+alpha, non-interlaced","md5":"2804fa51106b86a6425539dec7e04eab","sha1":"91d6b89d898c9967700fe838e8174ec1544c0401","sha256":"33245dc7e0a3433ae7d822cf84f959ca1e790716a496d1e7edee9a474e1a535e","sha512":"e603f1eb0b544c6d0e7d17c11b99e430798ff895e97c3ab4d7a35dce00b28376c09bbe46c793872e4bb5e6b027c538b7f203f6390b9c7957e2402bd10c696be3","ssdeep":"","tlshash":"a2f0dc93e95de0e580588e98568e80c0ba3d386ef0c95339cc058b97645bef1b09a94f","first_seen":"2025-03-07T07:35:48.082766Z","last_seen":"2026-02-15T07:07:52.454963Z","times_seen":5,"resource_available":false,"data":null}},"time_used":164,"timings":{"blocked":135,"dns":0,"connect":0,"send":0,"wait":29,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/wordlist.js.download","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.711Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/wordlist.js.download HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":159,"timings":{"blocked":21,"dns":2,"connect":42,"send":0,"wait":42,"receive":1,"ssl":46},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/llfivon.webp","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:32.204Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/llfivon.webp HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:32 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/phase_2.php","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-02-15T07:02:30.332Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /phase_2.php HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Length: 11194\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=UTF-8\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Bootstrap","description":"Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.","website":"https://getbootstrap.com","common_platform_enumeration":"cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*","icon":"Bootstrap.svg","categories":["UI frameworks"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":185791,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"JavaScript source, ASCII text, with CRLF line terminators","md5":"2a496ad4e01c40082d778950bd267c2b","sha1":"e152d9e715770ac30c82755477ae83485a82665c","sha256":"6fc36f311000888703e62a24206a150329544a6dd2c5cd0b1bb076d461555782","sha512":"3a897192d40b30f076277511e19bb5c56df2972b718c0ea356fb7a7e9700ce3cd6fde81cd5584afdeccc137e267ffb0b2c7a9c925f72a76e3d07c4bc7c0c43e6","ssdeep":"384:J+ByOq3M2sb+61Z0c+wL6D4SBIjiCiOMBIZiCi0rdrEDBIGiCiIS/58UJN3o7KNc:IB3QMbKUzhucuIGrOUIgrptIXrd/eDN","tlshash":"ea04e762e2565bbca33167186b689122fe61130f83c18771364c7ce17fbbe50c1b5ea6","first_seen":"2026-02-15T07:02:59.522942Z","last_seen":"2026-02-15T07:02:59.522942Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2322,"timings":{"blocked":1130,"dns":1069,"connect":29,"send":0,"wait":33,"receive":24,"ssl":35},"alerts":{"ids":null,"analyzer":[{"sensor_name":"infosec_yara","sensor_type":"yara","title":"YARAhub by abuse.ch","description":"YARAhub by abuse.ch","scan_date":"2026-02-15","alert":"Detects file containing Telegram Bot API","trigger":"ledgerrecovery.group/phase_2.php","verdict":"malware","severity":"medium","comment":"","link":"https://yaraify.abuse.ch/yarahub/","meta":{"author":"rectifyq","date":"2024-09-07","description":"Detects file containing Telegram Bot API","rule":"telegram_bot_api","yarahub_author_twitter":"@_rectifyq","yarahub_license":"CC0 1.0","yarahub_reference_md5":"9DA48D34DC999B4E05E0C6716A3B3B83","yarahub_rule_matching_tlp":"TLP:WHITE","yarahub_rule_sharing_tlp":"TLP:WHITE","yarahub_uuid":"58c9e4fe-d1e9-46ed-913c-dba943ac16d6"}},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Suspicious - Suspicious Javascript code","verdict":"suspicious","severity":"medium","comment":"","tags":["suspicious"],"meta":null}]}},{"url":{"schema":"https","addr":"ledgerrecovery.group/css/index.css","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.669Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /css/index.css HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nLast-Modified: Wed, 11 Feb 2026 17:55:26 GMT\r\nETag: \"99e2-64a9013af1020-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Length: 5555\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":39394,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with CRLF line terminators","md5":"59072617e7bd21513bd337be4ea82a1c","sha1":"2a03e38620c8e15081507b1ce6c9df797c60d191","sha256":"78d0fa7daa96dc2fecf970547f0dfb602075ea4820c9265029f508ea97de5788","sha512":"ae1df7c015a159ee8a16a30a6fe29ae94cf5af270ff14b79cd3054b0fe6565c02e0bdb7b82110ed8a0d1477516a06144a5f396b0766d088e730426ce732e3854","ssdeep":"192:OvCZwCZtZKnCZa1C0YCZ9ZSPCZP5U6I+1EZdCZVFQP+TOUCZECZXCZ/CZJ9CZJoR:OsZ3eZ+ZRomP+sjbAGBZZf1Dos+q","tlshash":"70030369d601020a7137dae42fa21719e7e54023970222fd7fce6189cffa654c6a2fdd","first_seen":"2026-02-15T07:02:59.526167Z","last_seen":"2026-02-15T07:02:59.526167Z","times_seen":1,"resource_available":false,"data":null}},"time_used":32,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":31,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/bootstrap/jquery/jquery.min.js","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.673Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /bootstrap/jquery/jquery.min.js HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nLast-Modified: Wed, 11 Feb 2026 17:55:22 GMT\r\nETag: \"15851-64a9013760fc0-gzip\"\r\nAccept-Ranges: bytes\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nContent-Length: 30679\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":88145,"size_decoded":0,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (65450), with CRLF line terminators","md5":"2f772fed444d5489079f275bd01e26cc","sha1":"a8927ac2830b2fdd4a729eb0eb7f80923539ceb9","sha256":"2b381363dda049f2d49a59037b228bc865d51ffb977c8f5c3547d5c28de48e3a","sha512":"81f3b4d35aaa98af19a4d31ee5399d49e0f70ce52aadefffbf42c6c4489d9d50a49450eec8e9139a009da82b57bf677665a926d5ae913dfc4c74baeec186c422","ssdeep":"1536:jTExXUZinxD7oPEZxkMV4SYKFMbRHZ6H5HOHCWrcElzuu7BRCKKBEqBsojZlOPmw:jgZm0H5HO5+gCKWZyPmHQ47GKc","tlshash":"8f8319dd72c6706257b761ba00bf540bf236599e6c4d4410f124e8eabc78a4a823bf7d","first_seen":"2023-03-07T01:02:42Z","last_seen":"2026-08-13T22:17:29.359611Z","times_seen":7436,"resource_available":true,"data":null}},"time_used":67,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":38,"receive":29,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/main.js.download","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.715Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/main.js.download HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":239,"timings":{"blocked":51,"dns":3,"connect":58,"send":0,"wait":57,"receive":0,"ssl":63},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/wordlist.js.download","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.929Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/wordlist.js.download HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":28,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/Yzvm8sG7noXg.png","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.700Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/Yzvm8sG7noXg.png HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":203,"timings":{"blocked":175,"dns":0,"connect":0,"send":0,"wait":28,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/images/img-09.png","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.707Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /images/img-09.png HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nLast-Modified: Wed, 11 Feb 2026 17:55:29 GMT\r\nETag: \"230fe-64a9013e6998e\"\r\nAccept-Ranges: bytes\r\nContent-Length: 143614\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":143614,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 418 x 472, 8-bit/color RGBA, non-interlaced","md5":"4802f8dd82fb35e2b2828100e9947e45","sha1":"0a15b3d59241838cb750e50776370250cc88f938","sha256":"bac2c823a8696c6a658e36167eacd615f5ef53781274e77ddc8e9946205fe309","sha512":"da5414080c09692347c531f1bbc979f3a99fe64b2ea1ab1dc465c52cd078e9e962a8d27603dfb9baaf0d60075eefa55f45a1b18cbfb2bb74e8eecb935adc5710","ssdeep":"3072:Dp3KN5KWdNuZmOBLKm31qYj1VzDczkU3kPhTYaKzn4Rn:YBrdOBNl5dMkPhMdGn","tlshash":"56e3121f3a098b970945c5fd9980d1b6712b7f88ebaae9c4b761f05ad114ce40d3e36c","first_seen":"2023-09-20T12:12:09Z","last_seen":"2026-07-24T03:02:25.629685Z","times_seen":570,"resource_available":false,"data":null}},"time_used":168,"timings":{"blocked":133,"dns":0,"connect":0,"send":0,"wait":29,"receive":6,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/images/a9SypYD4A2v9.png","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.708Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /images/a9SypYD4A2v9.png HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nLast-Modified: Wed, 11 Feb 2026 17:55:27 GMT\r\nETag: \"23c2d-64a9013c88324\"\r\nAccept-Ranges: bytes\r\nContent-Length: 146477\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":146477,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 448 x 506, 8-bit/color RGBA, non-interlaced","md5":"8fbe43f9735ff736d9c271452699762a","sha1":"29c168cdf1634b7b55d16f8137c888d2e16c3516","sha256":"b98d5ed89d2ce6b5143e31feb7c4ed60b63c8c6e08ae4f60385a8e7bf6899c53","sha512":"d923bbf52d268253e374a8a61f693f6a5fb6d7331ccd9637cbcbc8f6f85cc1652c6b3b5118481c3405326906f4f93b73564d7af0e54339d99bc1e10adf93ac75","ssdeep":"3072:HC/sax0mllbd9cmi3qtLKxd5vSjyARWwCyXSNiZwHC8H3rJEnVlYH:HC/zOKFfiatLKxkyVdNrHOSH","tlshash":"47e312f39e41e8b235a96835d8249886c5558db172f2f23536b9007b2ef86748c3b9dc","first_seen":"2023-09-20T12:12:09Z","last_seen":"2026-07-24T03:02:25.634532Z","times_seen":642,"resource_available":false,"data":null}},"time_used":592,"timings":{"blocked":132,"dns":5,"connect":69,"send":0,"wait":66,"receive":197,"ssl":69},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/PageFiles/connect.mp4","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.955Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /PageFiles/connect.mp4 HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 404 Not Found\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nContent-Length: 283\r\nKeep-Alive: timeout=5, max=95\r\nConnection: Keep-Alive\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n","headers":null,"cookies":null,"status_code":"404","status_text":"Not Found","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":283,"size_decoded":0,"mime_type":"text/html; charset=iso-8859-1","magic":"HTML document, ASCII text","md5":"6f737abbd9d8564246fa49b17cacb739","sha1":"af5c067a81c48e6b3df099520d16ba0e40faba6a","sha256":"b127b4cd5bdceca608b40b9b3882311be174609a08708079edc3aab064c82570","sha512":"a7b6a71f94f837339d44e3070782fab1080fc53549f64a91666b09c5b2b55d408359b7b01123dd875e8945e1fb4222cf67f2192cee0d3e6a3156cb89b52b69f3","ssdeep":"","tlshash":"61d0eb9e5003a386085220a078c510c223cc13e6f03a81a83cc6e4cb03ac57ecdabec8","first_seen":"2026-02-15T07:02:59.51624Z","last_seen":"2026-02-15T07:07:52.464366Z","times_seen":2,"resource_available":false,"data":null}},"time_used":30,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":29,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledgerrecovery.group/images/Bflfh7PtIV1m.mov","fqdn":"ledgerrecovery.group","domain":"ledgerrecovery.group","tld":"group"},"ip":{"addr":"37.77.150.227","port":443,"asn":0,"as":"","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"media","requested_by":"https://ledgerrecovery.group/phase_2.php","date":"2026-02-15T07:02:31.958Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledgerrecovery.group","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Wed, 11 Feb 2026 16:21:50 GMT","end":"Tue, 12 May 2026 16:21:49 GMT"},"fingerprint":{"sha1":"75:F8:FC:DD:1B:E7:6B:A0:7E:58:2D:CE:08:A8:28:6E:84:C5:69:F3","sha256":"A8:73:03:1C:9B:41:15:37:9F:88:03:13:99:CB:80:C1:31:31:1C:B8:47:E4:C8:06:AF:79:9D:18:4D:93:EC:6B"}}},"request":{"raw":"GET /images/Bflfh7PtIV1m.mov HTTP/1.1\r\nHost: ledgerrecovery.group\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.5\r\nReferer: https://ledgerrecovery.group/phase_2.php\r\nRange: bytes=0-\r\nDNT: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: video\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nAccept-Encoding: identity\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 206 Partial Content\r\nDate: Sun, 15 Feb 2026 07:02:31 GMT\r\nServer: Apache/2.4.52 (Ubuntu)\r\nLast-Modified: Wed, 11 Feb 2026 17:55:28 GMT\r\nETag: \"c83fa-64a9013ce7e40\"\r\nAccept-Ranges: bytes\r\nContent-Length: 820218\r\nContent-Range: bytes 0-820217/820218\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: video/quicktime\r\n\r\n","headers":null,"cookies":null,"status_code":"206","status_text":"Partial Content","fingerprints":[{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Apache HTTP Server:2.4.52","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":820218,"size_decoded":0,"mime_type":"video/quicktime","magic":"ISO Media, Apple QuickTime movie, Apple QuickTime (.MOV/QT)","md5":"a6ca65b05c2b53811dc5f3aa831d5d84","sha1":"54ee5aceb438dea38b9e69c36a36761dd920ccab","sha256":"b496ef983f05c6079d119207ea8ccf7110704403de12b5affe96f4191bba7a95","sha512":"616b76df5da25b77aa8ff6b230cf0b98bc6a69de5ec592644f7331ba504b126a6c9c756148031b8d4ecea92f42ab8a9a4706a70b1ef45a68bd6f5b0c1e06a962","ssdeep":"12288:9zliWKJmKqhwbQEBeZRLV3ed29yTVgm1dY+671Y+JITWh/sxYh0IRLr:9zliXIGbHYZc2IVgyqdBY+2y1s00IRLr","tlshash":"52052335b722c989e0427dfbcf07d7e2461af3929e2b0795a776c36e1cd8702a80d459","first_seen":"2023-09-20T12:12:09Z","last_seen":"2026-07-24T03:02:25.624846Z","times_seen":543,"resource_available":false,"data":null}},"time_used":372,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":56,"receive":316,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-02-15","alert":"Sinkholed","trigger":"ledgerrecovery.group","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}