x2.c.lencr.org - URL scan, 24 Aug 2026
MalwareAnalyzer by Cyble scanned x2.c.lencr.org and returned a unknown verdict (score 6). The page resolved to 23.221.133.54 on Akamai Technologies, Inc. in AU. 1 domain and 1 IP were contacted. 1182 malware samples communicate with this URL (Phishing, Zusy, Changeup, Upatre). This is a point-in-time observation from 24 Aug 2026; the page may have changed since.
Scan result
- Verdict: unknown (score 6) · Confidence 9%
- Scanned URL:
http://x2.c.lencr.org/ - Domain: x2.c.lencr.org · IP: 23.221.133.54 · AS16625 · AU
- Server: nginx
- HTTP status: 200 · application/pkix-crl
- Scan tier: fast · observed 2026-08-24 04:52:27 UTC
Malware communicating with this URL (1182)
These samples were observed contacting or being served from x2.c.lencr.org. Each links to its full analysis.
- 0e9ae7a4778e1acf7b7b6aac7fb82d94d6fcc23002e56db896cc9e7433c407d1 - contacted ·
0e9ae7a4778e1acf7b7b6aac7fb82d94· first seen 2026-08-24 - Phishing - contacted ·
acb8c946f8a69fd5a7d37a66878ac454· first seen 2026-08-24 - Zusy - contacted ·
93c486bf53861b10628ce682370241e5· first seen 2026-08-24 - 5edb6cb0d8b9be0b2697ab7cf7b10a99fccde29d4c53ef8b92452563168e41dd - contacted ·
5edb6cb0d8b9be0b2697ab7cf7b10a99· first seen 2026-08-24 - Phishing - contacted ·
4b2937ea6e8d25a93d4f5583db8f4eb6· first seen 2026-08-24 - Changeup - contacted ·
9a3b17033c7c340651ac59dadf68a3c7· first seen 2026-08-24 - Phishing - contacted ·
641fde8ba557a531f11abd1b792a45f2· first seen 2026-08-24 - Zusy - contacted ·
2ae847004f98cfbc26f0704ef25bf585· first seen 2026-08-24 - a7be4236158a83a80076be980aba726538830301133df02d185b1b4594850de1 - contacted ·
a7be4236158a83a80076be980aba7265· first seen 2026-08-24 - Zusy - contacted ·
11521ee4a5347e2457b6563c649dc6e6· first seen 2026-08-24 - dbe9e9c10bb6842a7e0b0494a31bfdd972e137d3fc4d8049ad139b8ba53c5c3c - contacted ·
dbe9e9c10bb6842a7e0b0494a31bfdd9· first seen 2026-08-24 - Phishing - contacted ·
cee85b467b06c02c5324c0c60d0c99cd· first seen 2026-08-24 - ae3b4b1602b43062b494d45c33791279ce4be66d16c9e7e57454a25e6b2474f9 - contacted ·
ae3b4b1602b43062b494d45c33791279· first seen 2026-08-24 - Zusy - contacted ·
df8841187fcd03d9f7d9a326fa0cd35b· first seen 2026-08-24 - Upatre - contacted ·
5648f37a861168d505e0bc8a8020511a· first seen 2026-08-24
Antivirus & YARA (0 of 48 engines)
No engine flagged this page's content.
Why this verdict
- Served over plaintext HTTP
Detected technologies
- Nginx
Contacted infrastructure
- 23.221.133.54 - AS16625 Akamai Technologies, Inc. (Australia)
Observed indicators
- x2.c.lencr.org
- 23.221.133.54
- http://x2.c.lencr.org/
Other scans of x2.c.lencr.org (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - unknown ·
https://x2.c.lencr.org/ - 24 Aug 2026 - unknown
- 23 Aug 2026 - unknown ·
https://x2.c.lencr.org/ - 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown ·
https://x2.c.lencr.org/ - 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown ·
https://x2.c.lencr.org/ - 23 Aug 2026 - unknown
- 23 Aug 2026 - unknown ·
https://x2.c.lencr.org/ - 23 Aug 2026 - unknown
Questions about x2.c.lencr.org
- Is x2.c.lencr.org safe?
- The scan of x2.c.lencr.org on 24 Aug 2026 reached no verdict either way (score 6). Too little was captured to judge it, which is an unknown rather than a pass.
- What malware is associated with x2.c.lencr.org?
- 1182 analysed samples communicate with this URL, including Phishing, Zusy, Changeup, Upatre.
- How was x2.c.lencr.org checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of x2.c.lencr.org
Scanned on MalwareAnalyzer by Cyble · Open interactive scan