x1.c.lencr.org - URL scan, 24 Aug 2026
MalwareAnalyzer by Cyble scanned x1.c.lencr.org and returned a unknown verdict (score -12). The page resolved to 23.221.133.54 on Akamai Technologies, Inc. in AU. The domain was registered 2246 days ago through Cloudflare, Inc.. 1 domain and 1 IP were contacted. 603 malware samples communicate with this URL (Bulz, Upantix, Upatre, Zusy). This is a point-in-time observation from 24 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score -12) · Confidence 15%
- Scanned URL:
https://x1.c.lencr.org/ - Domain: x1.c.lencr.org · IP: 23.221.133.54 · AS16625 · AU
- Server: nginx
- HTTP status: 200 · application/pkix-crl
- Registrar: Cloudflare, Inc. · domain age 2246 days · created 2020-06-29
- TLS issuer: C=US, O=Let's Encrypt, CN=YR1 · valid to Nov 12 10: · subject CN=crl.root-x1.letsencrypt.org
- Scan tier: fast · observed 2026-08-24 02:27:29 UTC
Malware communicating with this URL (603)
These samples were observed contacting or being served from x1.c.lencr.org. Each links to its full analysis.
- 87efb47dd08a26640c9f875b7e395c40958cc79b9348d82d8ce23db358abeff2 - contacted ·
87efb47dd08a26640c9f875b7e395c40· first seen 2026-08-24 - Bulz - contacted ·
f722d94254cc7584d36582cbb3f3ebc7· first seen 2026-08-24 - b6e286bc11d4d633019461ff11c031ed0c38e6eaefcba67e59881e79daa2eb06 - contacted ·
b6e286bc11d4d633019461ff11c031ed· first seen 2026-08-24 - Upantix - contacted ·
366611e1ab8a6ce5f83299a492fd6531· first seen 2026-08-24 - b6e8b5fa383bb43957ce64b6f55454ce2285a8cc954f41c32c978eafcd6a7714 - contacted ·
b6e8b5fa383bb43957ce64b6f55454ce· first seen 2026-08-24 - b6e8beb17d43f3ed47433f1175961c4a77b30345145ba99001ab4c8abedb5ed3 - contacted ·
b6e8beb17d43f3ed47433f1175961c4a· first seen 2026-08-24 - b6e35666a1663be4d084420d20fcde7064ab2ea5b71efb2c1b71824e5d8ec880 - contacted ·
b6e35666a1663be4d084420d20fcde70· first seen 2026-08-24 - b6eecd4f274f1286da647cfb0792c66a53b40f4328e778d2558588a62f2b2fe7 - contacted ·
b6eecd4f274f1286da647cfb0792c66a· first seen 2026-08-24 - 04bf0854ba764ccdb956cf225ef92fec57bf800845d21220af22cb8b77d08cec - contacted ·
04bf0854ba764ccdb956cf225ef92fec· first seen 2026-08-24 - b6e89411c62313bf48cd4634d7c6dd4654b2d4a357f39debb2c69d8a05f9b242 - contacted ·
b6e89411c62313bf48cd4634d7c6dd46· first seen 2026-08-24 - Upatre - contacted ·
5f026c2b627a9ea450aaa29f9ee80519· first seen 2026-08-24 - Zusy - contacted ·
484249b2aaa9133636261d8bc0369d9b· first seen 2026-08-24 - Zusy - contacted ·
884923985ef33c7b18be07983e388bd1· first seen 2026-08-24 - Ursu - contacted ·
fb4f8b9e5b279fda363e81c313878bcc· first seen 2026-08-24 - Delf - contacted ·
02b554cf9e3676241adaf10584844bfe· first seen 2026-08-24
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Valid TLS, no impersonation or off-origin credential post
Detected technologies
- Nginx
Contacted infrastructure
- 23.221.133.54 - AS16625 Akamai Technologies, Inc. (Australia)
Observed indicators
- x1.c.lencr.org
- 23.221.133.54
- https://x1.c.lencr.org/
Other scans of x1.c.lencr.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown
- 24 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
- 22 Aug 2026 - unknown
Questions about x1.c.lencr.org
- Is x1.c.lencr.org safe?
- The scan of x1.c.lencr.org on 24 Aug 2026 reached no verdict either way (score -12). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with x1.c.lencr.org?
- 603 analysed samples communicate with this URL, including Bulz, Upantix, Upatre, Zusy.
- How was x1.c.lencr.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of x1.c.lencr.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan