thelrfc.org - suspicious URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned thelrfc.org and returned a suspicious verdict (score 29), categorised as suspicious-infrastructure, credential-harvest. The page resolved to 23.227.38.70 on Shopify, Inc. in CA. 5 domains and 2 IPs were contacted, over 14 HTTP requests. The request followed 2 redirects before landing. This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: suspicious (score 29) · Confidence 44%
- Scanned URL:
http://lonerangerfanclub.com/ckfinder/userfiles/files/kopujafizune.pdf - Domain: thelrfc.org · IP: 23.227.38.70 · AS13335 · CA
- Server: cloudflare
- Page title: 404 Not Found - TheLRFC
- HTTP status: 404 · text/html; charset=utf-8
- TLS issuer: C=US, O=Let's Encrypt, CN=YE2 · valid to Nov 7 17: · subject CN=thelrfc.org
- HTTP requests captured: 14
- Scan tier: standard · observed 2026-08-20 18:20:37 UTC
Redirect chain
http://lonerangerfanclub.com/ckfinder/userfiles/files/kopujafizune.pdfhttps://lonerangerfanclub.com/ckfinder/userfiles/files/kopujafizune.pdfhttps://thelrfc.org/ckfinder/userfiles/files/kopujafizune.pdf
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Categories
- suspicious-infrastructure
- credential-harvest
Why this verdict
- Algorithmically-generated (DGA-like) hostname
- Valid TLS, no impersonation or off-origin credential post
- Credential-harvesting form
- Matches phishing-kit family "Meta / Facebook Login Kit"
- Cross-host redirect chain
Detected technologies
- Cloudflare
- Shopify
Contacted infrastructure
- 23.227.38.70 - AS13335 Shopify, Inc. (Canada)
- 23.227.38.32 - AS13335 Shopify, Inc. (Canada)
Observed indicators
- thelrfc.org
- cdn.shopify.com
- fonts.shopifycdn.com
- shop.app
- monorail-edge.shopifysvc.com
- 23.227.38.70
- 23.227.38.32
- https://thelrfc.org/ckfinder/userfiles/files/kopujafizune.pdf
- https://thelrfc.org/404
- https://cdn.shopify.com/
- https://fonts.shopifycdn.com/
- https://thelrfc.org/cdn/shop/t/3/assets/global.js?v=149496944046504657681671222365
- https://thelrfc.org/checkouts/internal/preloads.js?locale=en-AU
- https://shop.app/
- https://shop.app/checkouts/internal/preloads.js?locale=en-AU&shop_id=69428543779
- https://thelrfc.org/cdn/shopifycloud/shop-js/modules/v2/loader.init-shop-cart-sync.en.esm.js
- https://thelrfc.org/cdn/shopifycloud/storefront/assets/storefront/load_feature-1bd60354.js
- https://thelrfc.org/cdn/shopifycloud/storefront/assets/storefront/autosizes-84416378.js
- https://thelrfc.org/cdn/shopifycloud/storefront/assets/shopify_pay/storefront-bf1cdb70.js?v=20250812
- https://cdn.shopify.com/shopifycloud/storefront/assets/storefront/origin_trials-5059b83f.js
Other scans of thelrfc.org (3)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 22 Aug 2026 - suspicious ·
https://thelrfc.org/ckfinder/userfiles/files/24706249918.pdf - 20 Aug 2026 - suspicious
- 10 Aug 2026 - suspicious ·
https://thelrfc.org/ckfinder/userfiles/files/53367228111.pdf
Questions about thelrfc.org
- Is thelrfc.org safe?
- No. MalwareAnalyzer scanned thelrfc.org on 20 Aug 2026 and returned a suspicious verdict with a score of 29 out of 100, categorised as suspicious-infrastructure and credential-harvest. Treat it as hostile until it is re-checked.
- How was thelrfc.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the standard tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of thelrfc.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan