{"report_id":"dc119150-9193-449d-bf65-0f5ad7bf940f","version":6,"status":"done","tags":[],"date":"2025-12-17T09:30:47Z","url":{"schema":"https","addr":"auth-liveledger-live.com/","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"auth-liveledger-live.com/","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"title":"Ledger Live | Download and install Ledger Wallet™","dom":{"size":71477,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (44769)","md5":"7e07b29d3ca813b1413bbd4ef8a8c8f9","sha1":"9d861f14b9a5fc05a47d785e2b6a8a55a83f3002","sha256":"9da9b9ccb8dfe02642a299e1c133a564054547f01ec108ea0b09d46c1b564c1b","sha512":"422076bb665c9a3a4b2904e569406a4878442d919f9164263d7f475c15cf513e9db17e6eb1c36d438d4a52eefe8b2a488fb8e4ef24d4df69cb789a2272254ac7","ssdeep":"1536:JXx/c64Jysq7vtQ5kddddZJJJJPJJJJ9JJJJiJJJJVJJJJLJJJJBvr6:JWLu","tlshash":"bb63b875360c3e2ca81b97e4f794b76c623ca042fe5a906cb17c146567c7dd8b83ba84","dom_hash":"domhash4ff4cff894044a9c94fc50e5458d8c0f","first_seen":"2025-12-17T09:30:54.731997Z","last_seen":"2025-12-17T09:30:54.731997Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"auth-liveledger-live.com/","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"tags":null,"meta":null,"user":{"user_id":"akbkyowd9geqr98"}},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-01-21T09:30:47Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"www.ledger.com","ip":{"addr":"172.64.153.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"1994-09-19","domain_rank":203249,"first_seen":"2017-03-23T14:26:33Z","last_seen":"2025-12-16T05:32:15.702842Z","alert_count":0,"request_count":1,"received_data":1480,"sent_data":444,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}]},{"fqdn":"auth-liveledger-live.com","ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":39,"request_count":13,"received_data":2249705,"sent_data":6032,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]},{"fqdn":"ledger-wp-website-s3-prd.ledger.com","ip":{"addr":"172.64.153.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"1994-09-19","domain_rank":4505517,"first_seen":"2024-08-20T20:24:25Z","last_seen":"2025-12-10T06:27:01.117187Z","alert_count":0,"request_count":1,"received_data":1208,"sent_data":676,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/index-q9_adv7o.js","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":false,"md5":"4cf7766988bab32afeed20f97c535e71","sha1":"fecc7cb7b7b1d2165cb13160203fb9da367a73a8","sha256":"54693333ac86f5de14fe6fd26f34f64037a651654f0aee643e10a8ff5559cef2","sha512":"9f131a10fd74487c09e5331ed2dbaa4a260bc11380b273219b4b03ee15a68e3679874bd6bc575167db533f658a57082056f9d409492abb46fa9052d9606b86c0","ssdeep":"6144:3wcMfHKBdI8f0XdyfV4MdTqt3pBPppbrNoMZf:0SNQcVHRqt3pBPppbrNouf","tlshash":"c5746dd8315db2366bb745e1406f5207b23c2823640e8860f129ed6e77b458a61bbffd","size":364058,"data":"","first_seen":"2025-12-17T09:30:54.743482Z","last_seen":"2025-12-17T09:30:54.743482Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/avatar-1.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.020Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/avatar-1.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:28 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 224040\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nConnection: keep-alive\r\nETag: \"6924d079-36b28\"\r\nExpires: Thu, 18 Dec 2025 09:30:28 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":224040,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"35ca32241d2d475722576f1cc069f52d","sha1":"2d91851fe59f568f4505873056f3d3feff896f0c","sha256":"45a7f49da357230fbbc0a30fb0f0f559217133ebe3609b5a5ca634ed391ab454","sha512":"21b4077992aeae9d73c543c49a521b10c5b67f25382bd01d2e9b209198cbe235db66638bb8b174ad727e307a955187c706e39f55e908aaabb71847ab99c2c709","ssdeep":"6144:ZsYwcOvpVKvJ6g9z7xriiaPi7z5Mjk1t5NFW9f0:AV8P9EiaPSz5yk75C98","tlshash":"862422a3c2c456ecd7da3a20f43247764987b600926966193b736f337b6cb0c73119aa","first_seen":"2025-12-17T09:30:54.735487Z","last_seen":"2025-12-17T09:30:54.735487Z","times_seen":1,"resource_available":false,"data":null}},"time_used":618,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":301,"receive":317,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/avatar-2.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.025Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/avatar-2.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:28 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 256067\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nConnection: keep-alive\r\nETag: \"6924d079-3e843\"\r\nExpires: Thu, 18 Dec 2025 09:30:28 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":256067,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"4ba7e058bee081c64bfc2d71918bcfb3","sha1":"e905c87a86914a22b28d656517ad9079e6a5f50d","sha256":"e3ddefbec8b97231ea1ad0efde252e908b79edf3bc789c0a50cc2d31600c1371","sha512":"d139f8040f9ad5182f9f48cae58aea4aa6247d530b2d476637dc48a973a7bb7a7b08c03ead5554fe88026ef827c12bb9ae35f1387c4420698e64f972893200ca","ssdeep":"6144:aAtt+FKrNr6tzQK2lK60zBNCUTBw/wURhJwgYPpKULPSlp:LtoMpetkVITxTC/9JCLqv","tlshash":"5644233cebc59a8bc375d43b72830fb4f2926f77b0fc6284811942a96bd15d135a9d04","first_seen":"2025-12-17T09:30:54.737553Z","last_seen":"2025-12-17T09:30:54.737553Z","times_seen":1,"resource_available":false,"data":null}},"time_used":803,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":316,"receive":487,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/avatar-5.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.033Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/avatar-5.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T23:57:25.058416Z","times_seen":17827247,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/avatar-6.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.059Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/avatar-6.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:28 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 366965\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nConnection: keep-alive\r\nETag: \"6924d079-59975\"\r\nExpires: Thu, 18 Dec 2025 09:30:28 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":366965,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"91b36a5beeb3954c90c27af1656f4440","sha1":"2cb6df7a0ed24506da23cc65e284b6576bb32375","sha256":"45c273eeb54c1082c934ae3b6acb35ca15eb156ea33e6a4d90e257d1793707a1","sha512":"30376f44764edd1f71a2eeb69663b37de85ce11a501657104900d9cf06e1a49ee4c774e7de794bd89a3f6aeb6fe212fdb0957c40da8644f7e1c7df5e5ed3df2c","ssdeep":"6144:IBmmgh03gjQYorebbKHQJp280cOHx7ZMQeJmi03HaLo3xh1qfJaI:IBmvhbQY5bbKm0cOHZi03+o3wRaI","tlshash":"2a74237cd628b849dd9e9b911b5f26f90e27c3f5a4ba8e44071651ca27cc0e91c20f97","first_seen":"2025-12-17T09:30:54.739746Z","last_seen":"2025-12-17T09:30:54.739746Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1047,"timings":{"blocked":579,"dns":0,"connect":0,"send":0,"wait":304,"receive":164,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2025-12-17T09:30:25.649Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:26 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":6189,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"7024dffd72ca8b65365c87c3bbe878b2","sha1":"0ab54acac9f37d95064e9139f47486ceec865973","sha256":"e02c9b7b570452af558cbef2d656a2f028a8401ec816ffa86a46db1debf92006","sha512":"dc38019b3fdc5d8e60bb872793ead287e7795154167bd316a06a0ce5b20ad634567be71efe60d64b6329aaa7ecd1956ed3ed9b4ff5a27ccbe7ce3a654886ce4b","ssdeep":"192:w5Ee8zt5DiwxCLwvuLOZiwN3ycLPKpdvOxXGLHiwgmjQIHQCa6UgD:lvgD","tlshash":"06d15297e9a18d460a19127574fbb28a6134404bc918bc8d77bc402f4fcdede82b7b8d","first_seen":"2025-12-17T09:30:54.740778Z","last_seen":"2025-12-17T09:30:54.740778Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1820,"timings":{"blocked":752,"dns":134,"connect":145,"send":0,"wait":310,"receive":0,"ssl":476},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/index-q9_adv7o.js","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:26.834Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/index-q9_adv7o.js HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:26 GMT\r\nContent-Type: application/javascript\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6924d079-58e1a\"\r\nExpires: Thu, 18 Dec 2025 09:30:26 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":364058,"size_decoded":0,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (35168)","md5":"4cf7766988bab32afeed20f97c535e71","sha1":"fecc7cb7b7b1d2165cb13160203fb9da367a73a8","sha256":"54693333ac86f5de14fe6fd26f34f64037a651654f0aee643e10a8ff5559cef2","sha512":"9f131a10fd74487c09e5331ed2dbaa4a260bc11380b273219b4b03ee15a68e3679874bd6bc575167db533f658a57082056f9d409492abb46fa9052d9606b86c0","ssdeep":"6144:3wcMfHKBdI8f0XdyfV4MdTqt3pBPppbrNoMZf:0SNQcVHRqt3pBPppbrNouf","tlshash":"c5746dd8315db2366bb745e1406f5207b23c2823640e8860f129ed6e77b458a61bbffd","first_seen":"2025-12-17T09:30:54.743482Z","last_seen":"2025-12-17T09:30:54.743482Z","times_seen":1,"resource_available":true,"data":null}},"time_used":784,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":469,"receive":315,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/index-Cza97HcX.css","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:26.835Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/index-Cza97HcX.css HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:27 GMT\r\nContent-Type: text/css\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nETag: W/\"6924d079-109b9\"\r\nExpires: Thu, 18 Dec 2025 09:30:27 GMT\r\nCache-Control: max-age=86400\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":68025,"size_decoded":0,"mime_type":"text/css","magic":"ASCII text, with very long lines (65536), with no line terminators","md5":"84c2c56de50de23fc58e246de4e19b7f","sha1":"d1db72f842c2bee6516e19de66c5f1850897c734","sha256":"441a65f44289da499770c49eb697931d0e807e22464ef7e27c2d36aac9f95820","sha512":"a85b1fc8c83fde0f6ac9830f13ec89c2ce06aa99d74a3dd31b5c066d75048ab7f748aaf4456921611709a40cf2e3dffcba119b0eaacad845b38485cbc64b8d3d","ssdeep":"1536:2hVFbYYkB6NFU5DyaGNCr378VQZkt5FNCo7/:2hVFrkWUYaGNCr378VQZkt5Ff7/","tlshash":"ce637419b919613e3c2791f883ccb9aca11af0c0de3b06b9be9a412167d37f61db7544","first_seen":"2025-12-17T09:30:54.745555Z","last_seen":"2025-12-17T09:30:54.745555Z","times_seen":1,"resource_available":false,"data":null}},"time_used":1755,"timings":{"blocked":639,"dns":1,"connect":146,"send":0,"wait":472,"receive":1,"ssl":492},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/avatar-4.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.028Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/avatar-4.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:28 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 222759\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nConnection: keep-alive\r\nETag: \"6924d079-36627\"\r\nExpires: Thu, 18 Dec 2025 09:30:28 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":222759,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"98c7a3ce815d849b8ec372662eb18ac9","sha1":"685215dc1e5bd34a9c6be53fe0fde79c338dbd0b","sha256":"64b4302fcd01dee1637f0147bb85253ec7178c842c0b17a50a2340f3e6b44fd7","sha512":"fd9bde887829a7cbfac65a8fb804b33cbe580d60e25db4e29d084ccedb90eda4292e535b596799906237479bca222bfd040e86548e68bfef33ea2e6b402c2862","ssdeep":"6144:lLc+JvF5e7ag1J42PkZKfu/F32pTKnvIXTxEl:lcQvF8TQMkZm+FLnvIDxu","tlshash":"d52422e3e38651f768f1022a939076ac8db3c21dffef4a18c26d7916185852669087fd","first_seen":"2025-12-17T09:30:54.747915Z","last_seen":"2025-12-17T09:30:54.747915Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2168,"timings":{"blocked":618,"dns":0,"connect":154,"send":0,"wait":460,"receive":468,"ssl":465},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/avatar-6.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.035Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/avatar-6.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T23:57:25.058416Z","times_seen":17827247,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/hero-ledger.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.056Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/hero-ledger.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:28 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 205755\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nConnection: keep-alive\r\nETag: \"6924d079-323bb\"\r\nExpires: Thu, 18 Dec 2025 09:30:28 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":205755,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"99f39f6ccd9d206f76431ef29c9d0f76","sha1":"fa931f1cf78ec683f97d5b7c4177eb483b80900b","sha256":"279fb2726bae5b0fd7ee9c0f68dc46fc4c9878b79a2ffd3fbfd7a97e9b78388c","sha512":"020e70489f17abad38b4a72e1cfed86dd7b4d238f2957d6841a2dd21ff21c1e809a0fd44e542a769f8144a8bacb2e9bd4ebace2f23f6f7cc9dfc88c2ba3e5ba8","ssdeep":"3072:SwapghNkTQ/m+cg2w7TpipWqEEkSDWW9jMXolHzzeJMbbx2Add5ORoJKIqEpN:SwapKNOnwvoWYVDWmHWGPvkOd","tlshash":"d514123b14d1344a7ed659b8345a33d0a6fc87a8dcd8ae31472d2a739eb167c05e1b22","first_seen":"2025-12-17T09:30:54.751897Z","last_seen":"2025-12-17T09:30:54.751897Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2203,"timings":{"blocked":646,"dns":1,"connect":174,"send":0,"wait":469,"receive":441,"ssl":470},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/avatar-5.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.058Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/avatar-5.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:28 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 236393\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nConnection: keep-alive\r\nETag: \"6924d079-39b69\"\r\nExpires: Thu, 18 Dec 2025 09:30:28 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":236393,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"6d0eb78e5817de47b023f63e7fcfb94b","sha1":"00ca4710fcfdd62bc6f73cab6822f5ed88809ee9","sha256":"5dbc28fac4a542da7358134963c0aaab35c3e735513ecea44f75d54d1334e9ad","sha512":"8cdb752a3dee71b057145cc0a8a28ed0561d9327e784a31b0ce1c794853e094f5ad2af56d7bfd94c3d9152ff3a4cdff072af4ec863ff123e9123adc94dc8206e","ssdeep":"6144:SNRw6mDjT+/D5SsSnYywcujnUGWlbVyL46qzrH:SNRw6mvKLbSnYywtEzyLNqzT","tlshash":"4a3423ebc56251f5c1cea67e63871c434b818d6d336ae3c5d87c93bab229b5c40668e0","first_seen":"2025-12-17T09:30:54.754183Z","last_seen":"2025-12-17T09:30:54.754183Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2315,"timings":{"blocked":648,"dns":1,"connect":176,"send":0,"wait":513,"receive":503,"ssl":472},"alerts":{"ids":null,"analyzer":[{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/avatar-3.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"23.177.185.97","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.027Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"auth-liveledger-live.com","organization":""},"issuer":{"commonName":"R12","organization":"Let's Encrypt"},"validity":{"start":"Mon, 24 Nov 2025 20:49:50 GMT","end":"Sun, 22 Feb 2026 20:49:49 GMT"},"fingerprint":{"sha1":"81:B8:E6:07:71:BD:C0:A7:AA:F9:AB:BA:4F:E0:0E:E4:FB:4E:CF:E9","sha256":"76:01:06:DE:9D:81:DD:BA:C0:12:7C:68:BD:10:86:88:D9:E5:48:89:7A:4A:15:32:C0:E0:ED:EE:64:47:E5:FB"}}},"request":{"raw":"GET /assets/avatar-3.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx\r\nDate: Wed, 17 Dec 2025 09:30:28 GMT\r\nContent-Type: image/jpeg\r\nContent-Length: 296470\r\nLast-Modified: Mon, 24 Nov 2025 21:39:05 GMT\r\nConnection: keep-alive\r\nETag: \"6924d079-48616\"\r\nExpires: Thu, 18 Dec 2025 09:30:28 GMT\r\nCache-Control: max-age=86400\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":296470,"size_decoded":0,"mime_type":"image/jpeg","magic":"JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1024x1024, components 3","md5":"f76aeab3c78edb942dcc4c26f30064d9","sha1":"29f1478b867249534fa44212ed4b76b7f4edbaf3","sha256":"faecbe4b8f86ff4bdfa1b899ac0914456e11fdb56be8d73ec52bbffbecf1c54a","sha512":"d9ef55193e39aa7a362da547aba1cb0c21dd524b2794fe64779dbacd4a967f136dabd0654d18a3a56b3de6a19b2a1dee5b5deb105f54c7df77a1059306bebfc0","ssdeep":"6144:a7Q7DA2UHMQPM2Ln3iqeMH9rJU2C2Ag5wEdj31XidaEJn69It6I:aEQn7zLvdo32NwETSdHg4L","tlshash":"f754238e96272cbf2866593914bf3b99586ab31f856bc094510a30c2f1dcf7f84cc627","first_seen":"2025-12-17T09:30:54.756652Z","last_seen":"2025-12-17T09:30:54.756652Z","times_seen":1,"resource_available":false,"data":null}},"time_used":2199,"timings":{"blocked":620,"dns":1,"connect":152,"send":0,"wait":465,"receive":490,"ssl":469},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"ledger-wp-website-s3-prd.ledger.com/uploads/2021/11/Ledger_favicon.png","fqdn":"ledger-wp-website-s3-prd.ledger.com","domain":"ledger.com","tld":"com"},"ip":{"addr":"172.64.153.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:30.079Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Dec 2025 08:47:25 GMT","end":"Sat, 14 Mar 2026 09:47:04 GMT"},"fingerprint":{"sha1":"E8:65:70:24:D0:62:16:F3:B8:FB:D5:C5:E3:12:0D:4E:AA:B7:7C:C7","sha256":"D3:DB:92:90:E0:39:FA:68:B9:93:3B:CC:7E:8F:D2:0E:81:4C:90:0F:C9:D3:3B:1F:5D:78:0C:73:8F:B9:DA:10"}}},"request":{"raw":"GET /uploads/2021/11/Ledger_favicon.png HTTP/1.1\r\nHost: ledger-wp-website-s3-prd.ledger.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nReferer: https://auth-liveledger-live.com/\r\nDNT: 1\r\nConnection: keep-alive\r\nCookie: __cf_bm=m73OD.FijCivRKg022jZOD_1JxbfGNpp..ieXVtfArs-1765963830-1.0.1.1-QsgFfs88NhLCpvdKNU6FgSH9dTz3CGhna8.38n6R3ySJGP0lQZ3bIE7DllxYc7n24Oh52Q0YVO.vsGsZQ6WvQJ0s8L2QRJMH5S7enmFzqS8\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\ndate: Wed, 17 Dec 2025 09:30:30 GMT\r\ncontent-type: image/webp\r\ncontent-length: 402\r\ncf-ray: 9af566f20c157129-OSL\r\ncf-bgj: imgq:100,h2pri\r\ncf-polished: origFmt=png, origSize=2372\r\ncontent-disposition: inline; filename=\"Ledger_favicon.webp\"\r\netag: \"d2cc487e1baee412d24282cd76326b67\"\r\nlast-modified: Mon, 04 Mar 2024 09:59:32 GMT\r\nvary: Accept\r\nx-amz-id-2: wn9ej9Yy/1J0SwG2pqVbzHiAy+0GI2Wttt7DhzdHn/etF5DpyKioUYLDPoEVF2VTpemUm5I9L60rHtfrHZ6hZQw+wcXgUP0Z\r\nx-amz-replication-status: COMPLETED\r\nx-amz-request-id: ZF3ETWBSK5R95MZ0\r\nx-amz-server-side-encryption: AES256\r\nx-amz-version-id: c0YzzGXb_FH8yQM1Y29J6JaRmyu3vJ3t\r\ncf-cache-status: HIT\r\nage: 19385\r\nexpires: Wed, 17 Dec 2025 13:30:30 GMT\r\ncache-control: public, max-age=14400\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":402,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"ae21ecb25616d3be96e987fe7af84d6e","sha1":"db559bfa16b130ab1b8c0b9b8693c807e29b3503","sha256":"7545b9667995fb98664f07b94793628ca6920fc953bb4eb924259480cae4bbe8","sha512":"02bbd8bdb2e77a6b39b14712828b719e7c036e006c792dd8f2d0150b09324dd2b2e7892cdbbe05cf7dc6d1d162af3ccadd65099806e857821de738228f2c3ef4","ssdeep":"","tlshash":"ede0f17081776c782de418f412ff520303ac0d5ed211021b43b5b82020f47d6134d193","first_seen":"2023-05-25T12:23:00Z","last_seen":"2026-08-10T05:01:36.469804Z","times_seen":1243,"resource_available":false,"data":null}},"time_used":41,"timings":{"blocked":0,"dns":5,"connect":1,"send":0,"wait":35,"receive":1,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"www.ledger.com/favicon.ico","fqdn":"www.ledger.com","domain":"ledger.com","tld":"com"},"ip":{"addr":"172.64.153.104","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:29.508Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ledger.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Sun, 14 Dec 2025 08:47:25 GMT","end":"Sat, 14 Mar 2026 09:47:04 GMT"},"fingerprint":{"sha1":"E8:65:70:24:D0:62:16:F3:B8:FB:D5:C5:E3:12:0D:4E:AA:B7:7C:C7","sha256":"D3:DB:92:90:E0:39:FA:68:B9:93:3B:CC:7E:8F:D2:0E:81:4C:90:0F:C9:D3:3B:1F:5D:78:0C:73:8F:B9:DA:10"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: www.ledger.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 302 Found\r\ndate: Wed, 17 Dec 2025 09:30:30 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://ledger-wp-website-s3-prd.ledger.com/uploads/2021/11/Ledger_favicon.png\r\ncf-ray: 9af566ee99467129-OSL\r\nx-redirect-by: WordPress\r\nstrict-transport-security: max-age=31536000; includeSubDomains\r\naccess-control-allow-origin: *\r\naccess-control-allow-credentials: true\r\naccess-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS\r\naccess-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization\r\naccess-control-max-age: 1728000\r\ncf-cache-status: EXPIRED\r\nexpires: Wed, 17 Dec 2025 13:30:30 GMT\r\ncache-control: public, max-age=14400\r\nset-cookie: __cf_bm=m73OD.FijCivRKg022jZOD_1JxbfGNpp..ieXVtfArs-1765963830-1.0.1.1-QsgFfs88NhLCpvdKNU6FgSH9dTz3CGhna8.38n6R3ySJGP0lQZ3bIE7DllxYc7n24Oh52Q0YVO.vsGsZQ6WvQJ0s8L2QRJMH5S7enmFzqS8; path=/; expires=Wed, 17-Dec-25 10:00:30 GMT; domain=.ledger.com; HttpOnly; Secure; SameSite=None\r\nvary: Accept-Encoding\r\nserver: cloudflare\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Cloudflare Bot Management","description":"Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots.","website":"https://www.cloudflare.com/en-gb/products/bot-management/","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["Security"]}],"data":{"size":402,"size_decoded":0,"mime_type":"image/webp","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T23:57:25.058416Z","times_seen":17827247,"resource_available":true,"data":null}},"time_used":564,"timings":{"blocked":0,"dns":6,"connect":1,"send":0,"wait":537,"receive":0,"ssl":20},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"auth-liveledger-live.com/assets/hero-ledger.jpg","fqdn":"auth-liveledger-live.com","domain":"auth-liveledger-live.com","tld":"com"},"ip":{"addr":"0.0.0.0","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://auth-liveledger-live.com/","date":"2025-12-17T09:30:28.029Z","timestamp":0,"http_version":"","security_state":"insecure","security_info":null,"request":{"raw":"GET /assets/hero-ledger.jpg HTTP/1.1\r\nHost: auth-liveledger-live.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://auth-liveledger-live.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-10T23:57:25.058416Z","times_seen":17827247,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2025-12-17","alert":"Sinkholed","trigger":"auth-liveledger-live.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}