{"report_id":"922acc06-5213-4027-b521-5b08be53e273","version":0,"status":"done","tags":[],"date":"2026-09-23T15:45:54Z","url":{"schema":"http","addr":"ledger-auth.com/check/starter.php","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"104.21.89.104","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"ledger-auth.com/check/starter.php","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"title":"Security Check - Ledger","dom":{"size":13841,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (765)","md5":"a59f445edec09fc3d53ebf9d7eea8785","sha1":"67081f62bf8be7ee2e5c24a6039b3cdbde8dc462","sha256":"13ec04289a1d82479552b8ba1c39fd1bdacbce29d05b09d47cf96d185e150ab7","sha512":"002ae999693f21aa41245cb4d52eb2312275cda582e18a28085f17ba08015450569c3552c9bf5be858999c5a89d202d1bbb5b91ee220d1e971508ea6784ad85b","ssdeep":"192:l4sXtQXnR98+em1l7rIl+ECwFp96fso7A9WLzGD0F8XTjFuSyJYT8A8W:lDiR98+3ss6asAF8XVt8W","tlshash":"fd52615a7aa30016684795b93ffb77046764d003c24fcc647edc6388dfc29985ea2bad","dom_hash":"domhash065f0dccc9e36aa10de99dd2f4c530a3","first_seen":"2026-09-23T15:46:05.481783Z","last_seen":"2026-09-23T15:46:05.481783Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"ledger-auth.com/check/starter.php","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"104.21.89.104","port":0,"asn":13335,"as":"Cloudflare, Inc.","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-28T15:45:54Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null},"summary":[{"fqdn":"ledger-auth.com","ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":111,"request_count":37,"received_data":859596,"sent_data":22433,"comment":"","tags":null,"fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/js/loading.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"33f0f5e841f548dc085538499f9ccde4","sha1":"2ee20a8583f1da24e5aa9021103e6691370ff2f3","sha256":"62c0820ce85e245acce99079f681eb4c2d926b48724848c611cc5f3e49a7a02b","sha512":"c028b2d6b1b6f75a5914a33d2e0ef29deb4468d96e74a1a717da4bf71d81893f3044cbc3cff6d0e8a8afe2ef0b53a56bfd3c82f024874e8f2e8fec54da702f64","ssdeep":"","tlshash":"9b41c04a5bf391265be736f9081b0904396944931b4ac9463d0c4164cff57be82b2bf9","size":1949,"data":"","first_seen":"2025-01-13T22:55:36.917797Z","last_seen":"2026-09-23T15:46:05.489558Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/js/logger.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"1ff39e985a8aae3e493bd515cc12e64a","sha1":"211c5110c4c8a15c8863d21c5609c3b47c31368a","sha256":"47f8b0b983da7e63e030fb09aa91223ba0840243567cc657f63ed640a0bb0f6d","sha512":"95295fbcde1bfb0aaa0140dfe55704800c1caf08355541b6b422fd1774b9e9094588457e96f8736880b51874e8f6260b464053f2d72a6d1e990d04be26359919","ssdeep":"","tlshash":"a8110c0f35ba0131427b20be058f8700b665c4c71a15cb523e8c2922af18d7e2af9b88","size":875,"data":"","first_seen":"2025-01-13T22:55:36.922958Z","last_seen":"2026-09-23T15:46:05.48472Z","times_seen":28,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/js/jquery.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"11c05eb286ed576526bf4543760785b9","sha1":"7faa15a054093f3b5d674e63b6567c835a6fa217","sha256":"5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55","sha512":"b096b9296ab717df5039e8a350e9bd3be0600e056dceb58105a819b63956ec5dc8e3b34ed4e68d26f6eeb7ef4a38f9a336be166f76e5538bd0890762f9993ac2","ssdeep":"6144:V0Hh4V/Y+TCtlIhTze/RZcYmDvzK8m/7EtPx+WI+Y7cFys/CL/+uQxN0IPfKuGAv:atZcYmDhOgPx+WI+Y7cFycuq1PfQAv5B","tlshash":"4454a4d9f78d112e423231aa9c2f12cdb77cd1b1560458aebd4d597c24a083d83baf7a","size":280364,"data":"","first_seen":"2023-03-07T01:03:49Z","last_seen":"2026-10-11T11:53:04.616166Z","times_seen":2694,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/starter.php","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"402687e9283b42782fae526f1b4bebb3","sha1":"6c316db170422e9437c5f20d5f700422c135004d","sha256":"538184696897552ca755095dc1a481c593fc1717c97f7ea1d61f922574fa74b1","sha512":"62a4d27610c7f40cc8fa010b930591795e38e92603c297256318e0822afcf502b54fe79c38eab89d8eb79420dc72cd9f3be8c5b9dfee7016d0583be5ff618cdb","ssdeep":"","tlshash":"75112b267692193a49eb01f9ffda93907852953791a4fc00745dc9412f48d4413f9ffe","size":1081,"data":"","first_seen":"2026-07-16T21:08:02.086538Z","last_seen":"2026-09-23T15:46:05.495282Z","times_seen":11,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/starter.php","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"a5c8dc31fd93a4e548d73b5754e107c1","sha1":"01ebc46be1b928cf8f043238d3d522baaa2b4738","sha256":"fbcb51de09b5d647ad3d1ada8f1bba657988e17d9130e8d58f3a8efbc4e4edea","sha512":"cd1cc5d23f4a06d892cfccc092ba44c1e7185efff08fdb6a436e0d5989a07b572cf9cce8653c560f8950668bf0c1fec0163447a863e51702fbf312a1b1faf686","ssdeep":"","tlshash":"83c02b8e5892008c23c608710a07312120bb0cf2000c5a00d000c7a2f43c33f0313a9f","size":136,"data":"","first_seen":"2026-09-23T15:46:05.496744Z","last_seen":"2026-09-23T15:46:05.496744Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/js/payform.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"179c2f04aff2d23f8cc3085318e071f3","sha1":"c92220130d70ffe02fe97fdcdb570a478a6e3e37","sha256":"4532984c494e94d7e4e1b66a83ba92f6696a0be16b76c40fe4fd60f631dc38a3","sha512":"6b860722b9c3833832360c783715c913d0affc0b9a5566f79aa26bc9c298fe852befe6789ac4a1a35ebaf3f623147cf7124a0ceb3f778ba05600dd8570b6e848","ssdeep":"384:AH24Y62HPCIzNXI6z7zByMnIEoipedWKRXzG:k3Y62HPw6H0EoiprQXzG","tlshash":"baa2cd8cfaf361e08227b13d47df95466634c993080ced657c4c5a606f12eac56f9be8","size":22474,"data":"","first_seen":"2025-01-13T22:55:36.921043Z","last_seen":"2026-09-23T15:46:05.488877Z","times_seen":61,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/js/starter-translations.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"dc9f7d9b279d439da26e068b7b865242","sha1":"954e2a3d0a77e5d4ad410a5678ad2eec218fb6fa","sha256":"3833378bbff83f7c16cb379a94ae1bb10822f25eddedba8f55935bbcf00df035","sha512":"3ef789d48419e988012ce2e14c72ed405833f1f9e67aa8e79307bc0d57d5197f31918c048dfd15785d615a934156d5b987e737871fcb46094d5620071545b04b","ssdeep":"96:W51UjIA2DFVAle1m0DdmMkWXisbKuVzzgE5ZUibpFmkqwnR2:W511AI630DdmMkWXisGuVzzgE5Cib7ml","tlshash":"5fa11258e07e4436068e026ba2d2348d75244083e42bbd0cbb5d474d6fd9d6e52bbdde","size":4901,"data":"","first_seen":"2026-09-23T15:46:05.486222Z","last_seen":"2026-09-23T15:46:05.486222Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"ledger-auth.com/check/starter.php","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-23T15:45:22.062Z","timestamp":1790178322062,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/starter.php HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nset-cookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887; path=/; secure\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BRv%2BER0jXAJ2fi8Ty%2BAlnpVhueBMpmXLpZ7iUZCcNP2kaPufqRZYa97yoUIpjtOU4iPKb3x7R%2FO3FFOvdpqT%2FEftGvZtGl7P58dtgrUvrLR1%2BT0MYLlteeXJJUZ%2BYTP8xyw%3D\"}]}\r\nvary: Accept-Encoding\r\ndate: Wed, 23 Sep 2026 15:45:22 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=0,i\r\ncontent-encoding: zstd\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad112e1bb4ee-OSL\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"520c0c24023ae7ea3dc1a482c9a29887","quoted":false,"path":"/","secure":true,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887; path=/; secure"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]},{"name":"jQuery","description":"jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.","website":"https://jquery.com","common_platform_enumeration":"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*","icon":"jQuery.svg","categories":["JavaScript libraries"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":13776,"size_decoded":4429,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (765)","md5":"1575fabae7121e3b25dbcc66ad426d62","sha1":"ef66b74e3877a44b3b70570b861fc71d3bbd69be","sha256":"ce6fd9dcfb59c2e726c9f25fde595899f2bf29dd2c7b3aa9394e758a0be86acf","sha512":"e031bc58ff4c800c9d1131e0ae2a859bf420dec266cd28828bddbb856f90b44d6cd558d4036c49d3ee8ea78f115ba00e392603a5b400dd4d4fdd20d3378f642c","ssdeep":"192:K4sXtQXnRK8LGm1l7rIl+ECwFp96fso7A9WLzGD0F8XTjFuSyJYBALM:KDiRK8Lfss6asAF8XVwLM","tlshash":"8252505a7aa30016684794b93ffb7b046764d003c24fcc647edc6388dfc29985ea27ad","first_seen":"2026-09-23T15:46:05.483373Z","last_seen":"2026-09-23T15:46:05.483373Z","times_seen":1,"resource_available":true,"data":null}},"time_used":264,"timings":{"blocked":-1,"dns":8,"connect":28,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/js/logger.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:22.517Z","timestamp":1790178322517,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/assets/js/logger.js HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Wed, 06 Sep 2023 15:29:16 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:22 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=M27JFHPX3awlI%2FfJDdWwquj1QiYGrdxnTpaU%2FJbrxU5xAO7dqZtu49dWmDIaYvaufy61avKxFFNjFzuOFC44fqzadKuZ9rvA6Kq3rXsmkoaA%2Fl6tSPRQsvrBEsA73OwZ1u4%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a3faad13be6cb4ee-OSL\r\ncontent-length: 300\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":875,"size_decoded":1049,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"1ff39e985a8aae3e493bd515cc12e64a","sha1":"211c5110c4c8a15c8863d21c5609c3b47c31368a","sha256":"47f8b0b983da7e63e030fb09aa91223ba0840243567cc657f63ed640a0bb0f6d","sha512":"95295fbcde1bfb0aaa0140dfe55704800c1caf08355541b6b422fd1774b9e9094588457e96f8736880b51874e8f6260b464053f2d72a6d1e990d04be26359919","ssdeep":"","tlshash":"a8110c0f35ba0131427b20be058f8700b665c4c71a15cb523e8c2922af18d7e2af9b88","first_seen":"2025-01-13T22:55:36.922958Z","last_seen":"2026-09-23T15:46:05.48472Z","times_seen":28,"resource_available":true,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/js/starter-translations.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:22.520Z","timestamp":1790178322520,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/js/starter-translations.js HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Thu, 27 Feb 2025 09:14:06 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:22 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=xlLFZNoWh%2Fvrk6%2FqJdeFoLy1oXSQiAj190Tn6vQb6ce9%2FFu9Iq5F5MlAJZ3FxaSsQGs%2BxVyyrgJSduNQN3HlU55kwMyI%2B9QQBhquNpuWBUCe9dipXaaP9hA3f5PT9d1NxUU%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3faad13be6db4ee-OSL\r\ncontent-length: 1249\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":4901,"size_decoded":2003,"mime_type":"text/javascript","magic":"Unicode text, UTF-8 text","md5":"dc9f7d9b279d439da26e068b7b865242","sha1":"954e2a3d0a77e5d4ad410a5678ad2eec218fb6fa","sha256":"3833378bbff83f7c16cb379a94ae1bb10822f25eddedba8f55935bbcf00df035","sha512":"3ef789d48419e988012ce2e14c72ed405833f1f9e67aa8e79307bc0d57d5197f31918c048dfd15785d615a934156d5b987e737871fcb46094d5620071545b04b","ssdeep":"96:W51UjIA2DFVAle1m0DdmMkWXisbKuVzzgE5ZUibpFmkqwnR2:W511AI630DdmMkWXisGuVzzgE5Cib7ml","tlshash":"5fa11258e07e4436068e026ba2d2348d75244083e42bbd0cbb5d474d6fd9d6e52bbdde","first_seen":"2026-09-23T15:46:05.486222Z","last_seen":"2026-09-23T15:46:05.486222Z","times_seen":1,"resource_available":true,"data":null}},"time_used":119,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":119,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:38.133Z","timestamp":1790178338133,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=mB0C%2FAzgkqAB0WopwbJg2g6EOdRAksKsHnB1J%2F5PnUEAEkiYnz0A7tfc9sitBca6PlTzQoOI16HR%2FtPWpEoiEfJhrWuwRLosfkxF8LoiIArSEUA%2FaHlB7wUN9hk92bUxd%2Fo%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:38 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad7558feb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":711,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":87,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":87,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:41.133Z","timestamp":1790178341133,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=0zMrLNjgFt%2Frs%2FrbbaqMhpptH3vnMjImrowiSlJ4MbykzFGFZNOi91NGjx2C1EI%2FAZvGNe1lwsqvR3c2WskjA5Kj6Cn%2B8GPmO9HCvfxX%2B8dhZo%2BkyHxlgvfILGwARCWSScU%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:41 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad881b48b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":713,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":62,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":62,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:47.134Z","timestamp":1790178347134,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KFnqkUMICuusz0vTWxcPm3fAAtEElgh3fMARXHd8qvWMHtDqJ9mTJfik7Ysj%2BU0Fr1pQ%2B825SFoOwTbsTD8qdwCflL%2FWuLHdIo%2BwveptqmdQNXASYscwEEPpYANBBi8tWYU%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:47 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faadad9f4fb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":709,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:49.134Z","timestamp":1790178349134,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=goY9Ipa2Q2RNxx43L9E5ErUX2vg3tneazROX%2BDmXRJnnj1ptcAIkc%2BItsnO%2ByWH3ekoUXZdFODell6aaFYmYuUS9jxmA%2F80TNOP0fW8l%2FmarN%2FisPjDXDz5PTT1QyZ1K4Wg%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:49 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faadba186eb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":713,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/js/jquery.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:22.510Z","timestamp":1790178322510,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/assets/js/jquery.js HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Wed, 06 Sep 2023 15:29:16 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:24 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=B7bjZgpBiEqHp8U3F2KsQ1U3%2BqSmuDXEXha49vLzgwByCKi6tYG5bGwWYP4Pw5t7MKgThJhxbtNNQi0g8zTd8y2Lvwdu%2BYu4gMoURXhrdZF79THkVA3dS9zpN6hzBMtfkoM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3faad13be68b4ee-OSL\r\ncontent-length: 80486\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":280364,"size_decoded":81235,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"11c05eb286ed576526bf4543760785b9","sha1":"7faa15a054093f3b5d674e63b6567c835a6fa217","sha256":"5a93a88493aa32aab228bf4571c01207d3b42b0002409a454d404b4d8395bd55","sha512":"b096b9296ab717df5039e8a350e9bd3be0600e056dceb58105a819b63956ec5dc8e3b34ed4e68d26f6eeb7ef4a38f9a336be166f76e5538bd0890762f9993ac2","ssdeep":"6144:V0Hh4V/Y+TCtlIhTze/RZcYmDvzK8m/7EtPx+WI+Y7cFys/CL/+uQxN0IPfKuGAv:atZcYmDhOgPx+WI+Y7cFycuq1PfQAv5B","tlshash":"4454a4d9f78d112e423231aa9c2f12cdb77cd1b1560458aebd4d597c24a083d83baf7a","first_seen":"2023-03-07T01:03:49Z","last_seen":"2026-10-11T11:53:04.616166Z","times_seen":2694,"resource_available":true,"data":null}},"time_used":2273,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":2272,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:30.924Z","timestamp":1790178330924,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BGzFmkxo%2F7nBeaUbB1SXyaNftN%2B4%2BCdhzrdXrKIO1h5B58YlqDkbBQaLbeCl9lP3nCOK4r7sWqFjFkRURSdxq92p8qseIZrozhkVYmBNbOyCRMQpKFUY141tEjTy27eKee0%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:30 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad484cecb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":707,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/js/payform.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:22.515Z","timestamp":1790178322515,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/assets/js/payform.js HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Wed, 06 Sep 2023 15:29:18 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:22 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SWuC8zcAz0mjabQldLA7yDSukoewalP4bvjTb0G7PITYTUqyv2QPF5ftyWTc8ZIUxEK%2F5JZTX4RyYWbhdI7D0qo77VGsWd308D3%2FCBJCMwtZxQZa4xETlUbZRacIoyxCMDM%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3faad13be6ab4ee-OSL\r\ncontent-length: 4308\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":22474,"size_decoded":5056,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (448)","md5":"179c2f04aff2d23f8cc3085318e071f3","sha1":"c92220130d70ffe02fe97fdcdb570a478a6e3e37","sha256":"4532984c494e94d7e4e1b66a83ba92f6696a0be16b76c40fe4fd60f631dc38a3","sha512":"6b860722b9c3833832360c783715c913d0affc0b9a5566f79aa26bc9c298fe852befe6789ac4a1a35ebaf3f623147cf7124a0ceb3f778ba05600dd8570b6e848","ssdeep":"384:AH24Y62HPCIzNXI6z7zByMnIEoipedWKRXzG:k3Y62HPw6H0EoiprQXzG","tlshash":"baa2cd8cfaf361e08227b13d47df95466634c993080ced657c4c5a606f12eac56f9be8","first_seen":"2025-01-13T22:55:36.921043Z","last_seen":"2026-09-23T15:46:05.488877Z","times_seen":61,"resource_available":true,"data":null}},"time_used":159,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":159,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:25.834Z","timestamp":1790178325834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VTAsmqwP8n%2FqqjkyiIr35%2FPCPJwz5%2FNO1%2BnifL20j7DayIWX%2FSfDcbbfZz%2FPn4e6Nst43WHPSJ%2BstIZLqWtMnKm5uQJbaU82z3vkLtPD%2Bmu0X%2BTYwjtowj7NlOV88Z94PYc%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:25 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad2878a5b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":719,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:28.835Z","timestamp":1790178328835,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=26rUvs7YGUY%2BiONe7jpBup%2BQclU7T7lL5WJ4GLgVgQIB8BnydNnQF%2Bfq7ayXz3lNmTH1LoBSuqWAGzAbE7KWUn7DCtQuJrlp%2BXH1h3PZBuTc3smVeuK2lKadlGlNwmGjkgc%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:28 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad3b3a80b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":709,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":99,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:29.921Z","timestamp":1790178329921,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ksyjjh7vKSeTNkGfQjCxGX72Xzy7em674Ngj7VigQZHsViHoBzheFOr5M9opk7SWuPLstZrFvUGeJqkkTGUJxUTn4EGxt5PB20u6o%2F7Fu6sfWRAZWrHUpXP27ACABnCukwQ%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:29 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad420b72b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":703,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":60,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":60,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:32.005Z","timestamp":1790178332005,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=%2BNKgK5z%2FwmFOLGFgeW6PRTALs98p4tY0MpzzHRP2%2FQXgPNDEx0Do7AlNezXfOevwc0ALQqsHaQU7PbFwlaYRRNUvsvULf91w3r5y9inqOdyk9JDVkbC1TT0TLldK2LD7LW8%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:32 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad4f0d63b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":707,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":53,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":53,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:33.066Z","timestamp":1790178333066,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=2ogIdTVMPHhE6tUz0zvoQav0K9tIrEZMkzdw%2BPWSschVc36sjl7tyYEysAzs3SLxi2fwh%2B%2F4M5dlzBpuCfuKpwXNAtI28lgAwPgN%2Fa4UUd0cqlxiMGTiOq8aaAeI6y97C5Y%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:33 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad55add2b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":709,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:39.132Z","timestamp":1790178339132,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=NUEzawqfMMa53xDQyHq5VoZFRqRKMsRqqRE1pcTUr%2FONAk7S3NqTwtdK2BWx233Y8PsMFBh%2BTk7cosi2WgBLEzfMEuxDVqBwFEohT5%2FmMymQQYNvNx0YVD30I1yvNhaCXEw%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:39 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad7b99dfb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":707,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:36.131Z","timestamp":1790178336131,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=C4x%2BjVSTKcXQrDqaidmHdK1ZlNSvhBkkNw4L7iDHdZR9dHtyIPCuHGU04DqNfAVzk8SE%2FhtoWWERUjj73p0YoDjlZLE0DRjnKximrYWJTou6v99Cy%2FLQHui70t6R5iD4Cck%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:36 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad68dfdab4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":707,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:37.130Z","timestamp":1790178337130,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Pdi%2BCjl9y%2FxGaXd2Gc5k1CYRgwWHEUGzCxjV6rwUNjidy1jC9UmH9cTK06NKR5Wvt6wlZf2JPlQCHZsadBTtHECHrByD%2Fii0Z%2FNz%2FJfl6u3xREu4j77LRMPHavcqRyeRo%2B0%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:37 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad6f1857b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":713,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":64,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":64,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:42.133Z","timestamp":1790178342133,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=KhNt8wDha%2BQdRrxLNDyAr86J7towNJxwegUcrAlzQDAXDht5A6p%2BaKQPdpNDMFfCtQA1mEqK9LJKkaCmxcmwhoZQzDeCNOTbN1pHBROUSIUzMjqVQJQOfCyZcFM0IBWjnJk%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:42 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad8e5c01b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:45.133Z","timestamp":1790178345133,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IuyxR2WlP5iVPZ%2B5hcGJLe1HIoUAhrOQDrfm71y%2FQzZY%2FuGsBlZFlnLrXrG8%2BbwJiG%2BOlbj4%2Be8mAVXAdZvO%2FKHknvhb14jgyDUx0hLb37FGyyUYstGRKpuWKmS0tkWkkVQ%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:45 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faada11e5bb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":715,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:40.132Z","timestamp":1790178340132,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=jsDfDQ1IvxKe1hAwa2axQYuJ6Bq6czfnO6OWs%2FcOLb5NcucfeEcMup9XbThJg6K%2BwdExRTuTrdZDw6YPntsgKhg5h%2Bp1xTsgWLx2xhvRDkwZ3kr%2Brtf4xW7stIwy%2BYX%2BmVY%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:40 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad81da6fb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":713,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":98,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":98,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:44.133Z","timestamp":1790178344133,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=q63U1zDK2S9L1YGs4LiVg4nj%2BX6tVJ0qNzsyXkoiOLG2UhOwxfvdYvMtzmz5fmI4I8zPvk1%2BvG0%2BsbuF93wRBxuih7ZpJxPkAz%2BTLfHiWFDKyX%2FdSxGWqel7czkuLDD0g%2BE%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:44 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad9addf2b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":713,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:46.134Z","timestamp":1790178346134,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WFgojD%2BhRKdIUw0m0ElVgQuANGP1%2F5OWB1r39Jri7hfxCmqKNmXkyg7kPViK2BJPg4z1Gu6S9K1Hoxd8LuaVGUqSpZ0hV%2FNvOloBw9jE8oaP9IwIJTpRbfoVNOj%2B1YYR89E%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:46 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faada75ef7b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":709,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":63,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":63,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:50.136Z","timestamp":1790178350136,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=wVoEDsWdZNttz%2FbysqdwGKG%2BC34JCklS72s%2F8p5Tr0inVA2gefnWtJXQvQYGYG26D1CF1LD2nMWfpq4im2I0KfP48yx8ABRu3GjrvNPn3X6GvNw12ybSLRldN1D3vPfrfA4%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:50 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faadc0591cb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":707,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:51.135Z","timestamp":1790178351135,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=DXV2CIArByGk2MEes0E2I75kn0Jg3BV97Nj0%2FtcneF3%2BuxhbgSrT4Uwq38WH8YNTfq%2BItbg42P6Zo%2BOXfIgm0dJqs0K3t%2BcOiurdujtP0LHhP5footuKocGBuMDcovDWCfI%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:51 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faadc69a6ab4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":711,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/js/loading.js","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:22.512Z","timestamp":1790178322512,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/assets/js/loading.js HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncontent-type: text/javascript\r\nlast-modified: Wed, 06 Sep 2023 15:29:16 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:22 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncache-control: max-age=14400\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ILDt73Loy0opeSxe0p9lot%2BmvC52A0M9LAhMdDoNlkIP93eJst2bM77pWJ6Z0D1MhOiM8JSdpBaAilI1py8ZzKAVeQ%2Bu2NP0mWE9V2KW6fv5N%2FaRfBzTKPD4aK%2Bww7K6e3M%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=3,i=?0\r\ncf-ray: a3faad13be69b4ee-OSL\r\ncontent-length: 433\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":1949,"size_decoded":1184,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text","md5":"33f0f5e841f548dc085538499f9ccde4","sha1":"2ee20a8583f1da24e5aa9021103e6691370ff2f3","sha256":"62c0820ce85e245acce99079f681eb4c2d926b48724848c611cc5f3e49a7a02b","sha512":"c028b2d6b1b6f75a5914a33d2e0ef29deb4468d96e74a1a717da4bf71d81893f3044cbc3cff6d0e8a8afe2ef0b53a56bfd3c82f024874e8f2e8fec54da702f64","ssdeep":"","tlshash":"9b41c04a5bf391265be736f9081b0904396944931b4ac9463d0c4164cff57be82b2bf9","first_seen":"2025-01-13T22:55:36.917797Z","last_seen":"2026-09-23T15:46:05.489558Z","times_seen":28,"resource_available":true,"data":null}},"time_used":138,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":138,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/images/hero.webp","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:22.527Z","timestamp":1790178322527,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/images/hero.webp HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Wed, 30 Sep 2026 15:45:22 GMT\r\ncontent-type: image/webp\r\nlast-modified: Thu, 27 Feb 2025 08:23:54 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:22 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=VNEjWAkdYRZ0fJuz%2FRzpEUrBhfshQLIfHKKXOar9lxZoqV4gktB15MDQJ4yfI4qqmCm72zkv9TJDeKm%2B40FqXk2JXbYIvI3jXihjglAKHm68G6fFNQNFJrXQjYn%2Fd5oBVrA%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a3faad13ce70b4ee-OSL\r\ncontent-length: 368380\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]}],"data":{"size":368380,"size_decoded":369128,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f388742dc70f46bdb842f38bcf9869c5","sha1":"4427059e5d152fa845112961899a8ffbb74d142b","sha256":"27ff8a065138881bdc92f98ab4dac407f5903cff805d1a49a03eda24e36498ba","sha512":"4ff2358ca501dec6209e280189d600924df8ebb57f76316b024e5da82488d86de42bdcff86ad5f1ed7a3ee30e46b9f40a879c49ff9f078551a0e0eaa83a06388","ssdeep":"6144:1kneai5X1i9CxAgOa4ot5653nPrFULCGqbADmEgOYGOE:On4i9WAgOhTFyCGqUDb5ZO","tlshash":"ae7423a54709f98ed340323016da575acc9b08c6b6467ba34667b511fb26e8c06ccbff","first_seen":"2024-12-10T16:50:02.933596Z","last_seen":"2026-09-23T15:46:05.490609Z","times_seen":276,"resource_available":false,"data":null}},"time_used":3091,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":182,"receive":2909,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:26.834Z","timestamp":1790178326834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=6Nset3jeNbrOVvtS7AESQEaKW5SQNw5UhIv4AeDkKaFysOGxG%2B5r1GG36BwU36PWd4kIj%2BNk1xQpYl5t5j%2F4f2tCvnNRp3KMnxMZSs9WAGsCRiLsW7R8maOJG4DMlGq3fdY%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:26 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad2eb918b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":707,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:43.133Z","timestamp":1790178343133,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=fAoWnV9hBaMEjYu03Aa%2FzS8w7a%2BEiazEz6Ys7mFXlbON3KtZNTUa4CK1Jni9jpz33W53XSIlY8LhkrNaAkmpMn0Ogrxcm09Mc5jXVaNpiw0etksiX0YWbQJPpNFzPzs6mXU%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:43 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad949ce4b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":705,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":58,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":58,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/assets/plugins/@fortawesome/fontawesome-free/css/all.css","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:22.507Z","timestamp":1790178322507,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/assets/plugins/@fortawesome/fontawesome-free/css/all.css HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Wed, 30 Sep 2026 15:45:22 GMT\r\ncontent-type: text/css\r\nlast-modified: Wed, 06 Sep 2023 15:29:22 GMT\r\naccept-ranges: bytes\r\ncontent-encoding: br\r\nvary: Accept-Encoding\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:22 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PdxPt52GK%2FCTB%2FUuB9%2BTVqkRnE%2F9MX683LAbq1kzWGiS0xX8LLcNwlwLXhwCfeixE0pwdJX8pcMAfMdjnuKkVZVmC2MsZ0219BjA09XcqH8dKNxtJPOTpOfIdPf2UVVTLY0%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=2,i=?0\r\ncf-ray: a3faad13ae67b4ee-OSL\r\ncontent-length: 18423\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":123342,"size_decoded":19218,"mime_type":"text/css","magic":"troff or preprocessor input, ASCII text","md5":"fe11a3a32db7284d920063f21e7d3777","sha1":"850d2a2e0b6c640e41c71b2dab4b9d8cc562cdf6","sha256":"f155c0695c709ebdf9b5ade6f73516572a1fda0ad53a2577cd67c27309a53bb8","sha512":"13ee779179c9cae6454b3ef9c529937c2a54363de0a7d05df344de4103133c94d55834473cea4461ccc6c16b6c657bda8b3dbb72abe1747f14fa0fcd318b9adc","ssdeep":"1536:i8mrmZmrm7mrm8mrmCXmrm9mrmPmrm8slCB7Wm29eCFIEXoMEPlO6CxpIt2xNnJB:DmB7Wm29eYoMEPlOEt2xNnI6","tlshash":"9fc377fa90ff10d48311e4892747e2a4b739b62c9c0b4c58e2a67d8de6c065cb1d6bdd","first_seen":"2023-04-17T06:41:49Z","last_seen":"2026-10-11T21:46:51.570447Z","times_seen":282,"resource_available":true,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":162,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:27.834Z","timestamp":1790178327834,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=U7u0N9hbhhigvcjauDahmAlGr7UwepsVc4jZeJELtqc20MPaVV4bTPHz2I5f9tLER2lW6sWKiD166jqUUgnwpVIv7M5dXUYiaiyMqTVWUdm%2BC0E9g70X0TdtPwcaCZLvfcs%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:27 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad34f999b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":0,"size_decoded":703,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":59,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":59,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:34.067Z","timestamp":1790178334067,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=BZEMn5trXBBmLxqs1RAc8Ab296l%2Bj4rjEbF2EBGW9w0ryK6lDQq3kJ%2F5J9MGfyPKkStpzqacBxrNt28ALSrMXq%2Bekry2l2OwbVRCKtJ3MKYJ4qDnsmLJV%2FwvuCYghYSEGP0%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:34 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad5bee77b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":709,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":55,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":55,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:35.131Z","timestamp":1790178335131,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=FaE8VUfvLx8vh9B6AYGCgJsKpO1ogs3TDVDf4l2pFhPFWN3Ft1O6h5jjWbcNm9BwDdXhdPloFU63C4nlvjFi%2BXS9rSJDb3y1TihI1EMjW%2FIR%2FYyUlgVlhaz64eGZVFzlAoE%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:35 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faad629f4bb4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":707,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":52,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:48.134Z","timestamp":1790178348134,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WKYGd8i8ww7B9U7ufBsft39sK8pB7mXxwAfoYLlbwrTXQHx0bCX%2Fqv7Swj1q0Udixc0y8alQ%2Bajo5O1M5LTKo%2BXyJZ5T8491CN4Lp5FLSfplSKXwPJxCX2IEdg2tQxAzvOE%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:48 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faadb3dff0b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":0,"size_decoded":707,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":56,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"xhr","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:52.135Z","timestamp":1790178352135,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/admin/inc/action.php?type=loader\u0026page=starter.php\u0026loading=0\u0026fingerprint=a8318584-fcc7-b587-41a0-06e20e57c2a6 HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nX-Requested-With: XMLHttpRequest\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\ncontent-type: text/html; charset=UTF-8\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=akF7K0w0GGd3h%2FRo3kkH%2Bad3hGOS5f8Iwbsaxj2rDZPA%2B3qe2gDU%2FoNpvZTsAlxIPUPWIbRgtcfCKmi1h7NjlO4fzD84AgIy5omEsCzfktwjB6l79Sde%2FuZ3HQMzlezhsB8%3D\"}]}\r\ndate: Wed, 23 Sep 2026 15:45:52 GMT\r\nserver: cloudflare\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: DYNAMIC\r\npriority: u=3,i=?0\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\ncf-ray: a3faadccdae5b4ee-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nserver-timing: cfExtPri\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":0,"size_decoded":711,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-10-11T22:43:31.335783Z","times_seen":19039518,"resource_available":true,"data":null}},"time_used":57,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/images/logo.png","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:22.525Z","timestamp":1790178322525,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/images/logo.png HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Wed, 30 Sep 2026 15:45:22 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 15 Jan 2025 09:05:48 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:22 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=eGU%2FPlAg%2FutvRyE%2B%2BlKwDq0IORLjexi6oPBWmltVDFnHVIr797xmRWktMHWNsmUH%2Bn%2FwOPmCH1ynEhy4ikkiy8eqO2Rg2tyIzcjuJ%2FJVl7R%2BVJ57Hb1koKJ7ZorBK%2Btu%2FNw%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=5,i\r\ncf-ray: a3faad13ce6fb4ee-OSL\r\ncontent-length: 16198\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]}],"data":{"size":16198,"size_decoded":16958,"mime_type":"image/png","magic":"PNG image data, 1600 x 534, 8-bit colormap, non-interlaced","md5":"66ebf946b0be5429cf2446d80b549a49","sha1":"9b561ca463f73dc2798dc3740cb01db469082aef","sha256":"8d35eb7c0cd45f81ece10eda9fc4788d3ba6d34dfbd110975164d2ecef38ffc2","sha512":"4f0a1f2f1f7c3f5d82e8ebda179fd3cf973480cc417e7c2c18ce241f5658cefedae78b5c95afed6f7d8cf9a045b764d432c2deda5022550c8a245faf77f264d0","ssdeep":"384:BDYbWjWHQPeR9QMwsY7Xju1ZogDSw1aIcC:4g+wi1ZoscC","tlshash":"9e72ae4fb91a8f15f5cd28b09b8aa384e50abc4635c8d8f07e8ab304d935b5654e36e1","first_seen":"2026-09-23T15:46:05.492483Z","last_seen":"2026-09-23T15:46:05.492483Z","times_seen":1,"resource_available":false,"data":null}},"time_used":162,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":136,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-auth.com/check/images/Ledger_favicon.png","fqdn":"ledger-auth.com","domain":"ledger-auth.com","tld":"com"},"ip":{"addr":"172.67.157.224","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://ledger-auth.com/check/starter.php","date":"2026-09-23T15:45:24.974Z","timestamp":1790178324974,"http_version":"HTTP/3","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger-auth.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 30 Jul 2026 21:28:55 GMT","end":"Wed, 28 Oct 2026 22:25:28 GMT"},"fingerprint":{"sha1":"83:CA:C5:7B:2B:B4:84:17:7A:86:D3:FC:EA:6C:6B:58:76:0C:9A:40","sha256":"45:AF:76:4D:1B:6C:BF:21:A5:42:86:7B:60:40:73:AB:73:6A:BB:13:BB:57:DF:68:93:E0:BC:79:5D:33:94:AE"}}},"request":{"raw":"GET /check/images/Ledger_favicon.png HTTP/1.1\r\nHost: ledger-auth.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://ledger-auth.com/check/starter.php\r\nCookie: PHPSESSID=520c0c24023ae7ea3dc1a482c9a29887\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/3 200 \r\ncache-control: public, max-age=604800\r\nexpires: Wed, 30 Sep 2026 15:45:25 GMT\r\ncontent-type: image/png\r\nlast-modified: Wed, 15 Jan 2025 09:35:42 GMT\r\naccept-ranges: bytes\r\nserver-timing: cfExtPri\r\ndate: Wed, 23 Sep 2026 15:45:25 GMT\r\nserver: cloudflare\r\nalt-svc: h3=\":443\"; ma=86400\r\nx-turbo-charged-by: LiteSpeed\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HRXmdCOUngpnnkJA9v3hEI%2BKLeaup9tzSAENJyX4eUpD0K1DhhGMYXF7E7Rp1ihtXNjCiljyknQ2YZp4IeMHzTSCqYP6s7W9PCCT98Xi3%2F9EDjgzOSINpVGWHCx19na9eDc%3D\"}]}\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\npriority: u=6,i=?0\r\ncf-ray: a3faad231805b4ee-OSL\r\ncontent-length: 560\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Litespeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://wordpress.org/plugins/litespeed-cache/","common_platform_enumeration":"","icon":"litespeed-cache.png","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed Cache","description":"LiteSpeed Cache is an all-in-one site acceleration plugin for WordPress.","website":"https://www.litespeedtech.com/products/cache-plugins/wordpress-acceleration","common_platform_enumeration":"","icon":"LiteSpeed.svg","categories":["Caching","WordPress plugins"]},{"name":"LiteSpeed","description":"LiteSpeed is a high-scalability web server.","website":"https://litespeedtech.com","common_platform_enumeration":"cpe:2.3:a:litespeedtech:litespeed_web_server:*:*:*:*:*:*:*:*","icon":"LiteSpeed.svg","categories":["Web servers"]}],"data":{"size":560,"size_decoded":1305,"mime_type":"image/png","magic":"PNG image data, 300 x 300, 4-bit colormap, non-interlaced","md5":"497a7d95c574910c917687e07a22c1f6","sha1":"448c55ae9cb98952270f08a4431fab6b0c5f2843","sha256":"175e87f685a33f7842d605027a189040a6e12383923b85eded8525e156833516","sha512":"950aedaedd04b0de0427910867b9f0ac7e205d1de4e055db08e3955774392b7958a60b72b8f8ca41ac2bf012024a70efa71ad1f3ef29721f782bd31f95946bdc","ssdeep":"","tlshash":"12f0f1e323a3ed14c649403b800f9250cd72c27a5c659879c4ad6dbc6df3bc2c9d1b92","first_seen":"2026-09-23T15:46:05.493738Z","last_seen":"2026-09-23T15:46:05.493738Z","times_seen":1,"resource_available":false,"data":null}},"time_used":167,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":167,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-23","alert":"Sinkholed","trigger":"ledger-auth.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-23","alert":"Phishing Block","trigger":"ledger-auth.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}