{ "schemaVersion": "1.0.0", "dataset": "cloudscout-sukciu-radaras", "publisher": "CloudScout · https://radaras.cloudscout.lt/", "licence": "CC-BY-4.0", "notice": "Kiekvienas įrašas — pėdsakas (lead), ne nuosprendis. Domenai defanged (hxxps/[.]). Tik pasyvus OSINT iš viešų šaltinių; jokio skenavimo. Priskyrimas grupuotei — automatinis stebėjimas peržiūrai, ne teisinis įrodymas.", "generatedAt": "2026-09-01T11:45:28+00:00", "count": 130, "attributedCount": 86, "activeCount": 74, "removedCount": 47, "signals": [ { "id": "vcenix.info", "domain": "vcenix[.]info", "url": "hxxps://vcenix[.]info", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 11, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Reta, pigi galūnė .info — tokias mėgsta sukčiai." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "US", "asn": "AS22612 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "policija-gov.shop", "domain": "policija-gov[.]shop", "url": "hxxps://policija-gov[.]shop", "category": "policija", "brandGuess": "Policija", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno.", "Valdžios / baudos raktažodis + pigi galūnė.", "Reta, pigi galūnė .shop — tokias mėgsta sukčiai.", "Domenas labai naujas (18 d.) — dažna šviežių sukčių svetainių savybė." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "DE", "asn": "AS132203 DE", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "policija-gov-hr.lat", "domain": "policija-gov-hr[.]lat", "url": "hxxps://policija-gov-hr[.]lat", "category": "policija", "brandGuess": "Policija", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno.", "Valdžios / baudos raktažodis + pigi galūnė.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams.", "Reta, pigi galūnė .lat — tokias mėgsta sukčiai.", "Domenas labai naujas (12 d.) — dažna šviežių sukčių svetainių savybė." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "SG", "asn": "AS132203 SG", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "sercerto.com", "domain": "sercerto[.]com", "url": "hxxps://sercerto[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.", "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "RO", "asn": "AS200651 RO", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "ardenixs.com", "domain": "ardenixs[.]com", "url": "hxxps://ardenixs[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "RO", "asn": "AS200651 RO", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "swegenix.com", "domain": "swegenix[.]com", "url": "hxxps://swegenix[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "RO", "asn": "AS200651 RO", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "sierraelevate.com", "domain": "sierraelevate[.]com", "url": "hxxps://sierraelevate[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "US", "asn": "AS16509 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "avehicule.com", "domain": "avehicule[.]com", "url": "hxxps://avehicule[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "IS", "asn": "AS200651 IS", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "stalravia.com", "domain": "stalravia[.]com", "url": "hxxps://stalravia[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "RO", "asn": "AS200651 RO", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "clearpath-services.net", "domain": "clearpath-services[.]net", "url": "hxxps://clearpath-services[.]net", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "ZA", "asn": "AS214036 ZA", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "clasped-log.com", "domain": "clasped-log[.]com", "url": "hxxps://clasped-log[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "VirusTotal: 2 malicious / 2 suspicious (antivirusų reputacija).", "Turinys ar infrastruktūra atitinka žinomos sukčių grupuotės („kit“) parašą." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "ES", "asn": "AS174 ES", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "blueelm.website", "domain": "blueelm[.]website", "url": "hxxps://blueelm[.]website", "category": "kita", "brandGuess": "Kita", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 9, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "VirusTotal: 3 malicious / 2 suspicious (antivirusų reputacija).", "Turinys ar infrastruktūra atitinka žinomos sukčių grupuotės („kit“) parašą.", "Reta, pigi galūnė .website — tokias mėgsta sukčiai." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "AR", "asn": "AS27823 AR", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "08-27.digital", "domain": "08-27[.]digital", "url": "hxxps://08-27[.]digital", "category": "policija", "brandGuess": "Policija", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-30", "matchScore": 9, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Data pavadinime + pigi galūnė — „administracinės baudos“ schema (kaip 28-08.digital).", "Reta, pigi galūnė .digital — tokias mėgsta sukčiai.", "Domenas labai naujas (0 d.) — dažna šviežių sukčių svetainių savybė." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "drstellanet.com", "domain": "drstellanet[.]com", "url": "hxxps://drstellanet[.]com", "category": "kita", "brandGuess": "Kita", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 7, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno." ], "cluster": "Lucid (XinXin grupė)", "attributed": true, "hostingCountry": "RO", "asn": "AS200651 RO", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "elmridges.com", "domain": "elmridges[.]com", "url": "hxxps://elmridges[.]com", "category": "kita", "brandGuess": "Kita", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 7, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "US", "asn": "AS14956 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "solettu.com", "domain": "solettu[.]com", "url": "hxxps://solettu[.]com", "category": "kita", "brandGuess": "Kita", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 7, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "NL", "asn": "AS204196 NL", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "syntricapp.com", "domain": "syntricapp[.]com", "url": "hxxps://syntricapp[.]com", "category": "kita", "brandGuess": "Kita", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 7, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "FR", "asn": "AS12876 FR", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "hostastra8.com", "domain": "hostastra8[.]com", "url": "hxxps://hostastra8[.]com", "category": "kita", "brandGuess": "Kita", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 7, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "FR", "asn": "AS12876 FR", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "nseventure.com", "domain": "nseventure[.]com", "url": "hxxps://nseventure[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 6, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.", "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "RO", "asn": "AS200651 RO", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "www.netflix-login.blogspot.com", "domain": "www[.]netflix-login[.]blogspot[.]com", "url": "hxxps://www[.]netflix-login[.]blogspot[.]com", "category": "eshop", "brandGuess": "Parduotuvė", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 5, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „netflix“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "US", "asn": "AS15169 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "prisijungti-esodra.com", "domain": "prisijungti-esodra[.]com", "url": "hxxps://prisijungti-esodra[.]com", "category": "sodra", "brandGuess": "Sodra", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-30", "matchScore": 5, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Sodros raktažodis + neįprasta galūnė.", "Domenas labai naujas (0 d.) — dažna šviežių sukčių svetainių savybė." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "epaslaugos.icu", "domain": "epaslaugos[.]icu", "url": "hxxps://epaslaugos[.]icu", "category": "vmi", "brandGuess": "VMI", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „epaslaugos“, nors tai ne oficialus tos įstaigos adresas.", "Reta, pigi galūnė .icu — tokias mėgsta sukčiai." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": "AS13335", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "uull2policija.online", "domain": "uull2policija[.]online", "url": "hxxps://uull2policija[.]online", "category": "policija", "brandGuess": "Policija", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Valdžios / baudos raktažodis + pigi galūnė.", "Reta, pigi galūnė .online — tokias mėgsta sukčiai." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "sveikatosprotokolas.online", "domain": "sveikatosprotokolas[.]online", "url": "hxxps://sveikatosprotokolas[.]online", "category": "policija", "brandGuess": "Policija", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Vidutinis", "evidenceTier": "patvirtinta", "reasonCodes": [ "Valdžios / baudos raktažodis + pigi galūnė.", "Reta, pigi galūnė .online — tokias mėgsta sukčiai." ], "cluster": null, "attributed": false, "hostingCountry": "CY", "asn": "AS47583 CY", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "aprilljonsonsmartidhk.click", "domain": "aprilljonsonsmartidhk[.]click", "url": "hxxps://aprilljonsonsmartidhk[.]click", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Vidutinis", "evidenceTier": "patvirtinta", "reasonCodes": [ "Banko vardas + neįprasta galūnė.", "Reta, pigi galūnė .click — tokias mėgsta sukčiai." ], "cluster": null, "attributed": false, "hostingCountry": "US", "asn": "AS13335 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "omniva.online", "domain": "omniva[.]online", "url": "hxxps://omniva[.]online", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Vidutinis", "evidenceTier": "patvirtinta", "reasonCodes": [ "Pašto/kurjerio vardas + disposable galūnė.", "Reta, pigi galūnė .online — tokias mėgsta sukčiai." ], "cluster": null, "attributed": false, "hostingCountry": "CA", "asn": "AS13335 CA", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "clpexpress.top", "domain": "clpexpress[.]top", "url": "hxxps://clpexpress[.]top", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Pašto/kurjerio vardas + disposable galūnė.", "Reta, pigi galūnė .top — tokias mėgsta sukčiai." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "US", "asn": "AS13335 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "vitaglp-express.shop", "domain": "vitaglp-express[.]shop", "url": "hxxps://vitaglp-express[.]shop", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „lp-express“, nors tai ne oficialus tos įstaigos adresas.", "Reta, pigi galūnė .shop — tokias mėgsta sukčiai." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "DE", "asn": "AS31400 DE", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "flp-express.online", "domain": "flp-express[.]online", "url": "hxxps://flp-express[.]online", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.", "Pašto/kurjerio vardas + disposable galūnė.", "Reta, pigi galūnė .online — tokias mėgsta sukčiai." ], "cluster": "Susijusi grupė #0878FB", "attributed": true, "hostingCountry": "VG", "asn": "AS40034 VG", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospost.icu", "domain": "lietuvospost[.]icu", "url": "hxxps://lietuvospost[.]icu", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.", "Pašto/kurjerio vardas + disposable galūnė.", "Reta, pigi galūnė .icu — tokias mėgsta sukčiai." ], "cluster": "Susijusi grupė #14B660", "attributed": true, "hostingCountry": "DE", "asn": "AS47846 DE", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "esiunta.help", "domain": "esiunta[.]help", "url": "hxxps://esiunta[.]help", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Vidutinis", "evidenceTier": "patvirtinta", "reasonCodes": [ "Pašto/kurjerio vardas + disposable galūnė.", "Reta, pigi galūnė .help — tokias mėgsta sukčiai." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": "AS13335", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "ap-epaslaugos.lat", "domain": "ap-epaslaugos[.]lat", "url": "hxxps://ap-epaslaugos[.]lat", "category": "vmi", "brandGuess": "VMI", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Valdžios / baudos raktažodis + pigi galūnė.", "Reta, pigi galūnė .lat — tokias mėgsta sukčiai." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": "AS13335", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lt-mokesciai.info", "domain": "lt-mokesciai[.]info", "url": "hxxps://lt-mokesciai[.]info", "category": "vmi", "brandGuess": "VMI", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "VirusTotal: 6 malicious / 0 suspicious (antivirusų reputacija).", "VMI raktažodis + pigi galūnė.", "Reta, pigi galūnė .info — tokias mėgsta sukčiai." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "dokumntpolicija.info", "domain": "dokumntpolicija[.]info", "url": "hxxps://dokumntpolicija[.]info", "category": "policija", "brandGuess": "Policija", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Vidutinis", "evidenceTier": "patvirtinta", "reasonCodes": [ "Valdžios / baudos raktažodis + pigi galūnė.", "Reta, pigi galūnė .info — tokias mėgsta sukčiai." ], "cluster": null, "attributed": false, "hostingCountry": "US", "asn": "AS16509 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "nuobaudos-e-poli.info", "domain": "nuobaudos-e-poli[.]info", "url": "hxxps://nuobaudos-e-poli[.]info", "category": "policija", "brandGuess": "Policija", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.", "Valdžios / baudos raktažodis + pigi galūnė.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams.", "Reta, pigi galūnė .info — tokias mėgsta sukčiai." ], "cluster": "Susijusi grupė #3A2234", "attributed": true, "hostingCountry": null, "asn": "AS13335", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "vaizdas-patvirtinti-sesija.info", "domain": "vaizdas-patvirtinti-sesija[.]info", "url": "hxxps://vaizdas-patvirtinti-sesija[.]info", "category": "policija", "brandGuess": "Policija", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Vidutinis", "evidenceTier": "patvirtinta", "reasonCodes": [ "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams.", "Reta, pigi galūnė .info — tokias mėgsta sukčiai." ], "cluster": null, "attributed": false, "hostingCountry": "US", "asn": "AS14061 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "co.uk", "domain": "co[.]uk", "url": "hxxps://co[.]uk", "category": "kita", "brandGuess": "Kita", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "DE", "asn": "AS60068 DE", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospost.lat", "domain": "lietuvospost[.]lat", "url": "hxxps://lietuvospost[.]lat", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.", "Domene minimas „lietuvospost“, nors tai ne oficialus tos įstaigos adresas.", "Reta, pigi galūnė .lat — tokias mėgsta sukčiai." ], "cluster": "Susijusi grupė #0878FB", "attributed": true, "hostingCountry": "VG", "asn": "AS40034 VG", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "servionel.com", "domain": "servionel[.]com", "url": "hxxps://servionel[.]com", "category": "kita", "brandGuess": "Kita", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "RO", "asn": "AS200651 RO", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "codesaturno.com", "domain": "codesaturno[.]com", "url": "hxxps://codesaturno[.]com", "category": "kita", "brandGuess": "Kita", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "VirusTotal: 9 malicious / 0 suspicious (antivirusų reputacija)." ], "cluster": null, "attributed": false, "hostingCountry": "US", "asn": "AS14956 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "data-ivy.com", "domain": "data-ivy[.]com", "url": "hxxps://data-ivy[.]com", "category": "kita", "brandGuess": "Kita", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "US", "asn": "AS33387 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "maxibrant.com", "domain": "maxibrant[.]com", "url": "hxxps://maxibrant[.]com", "category": "kita", "brandGuess": "Kita", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 4, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "BR", "asn": "AS273584 BR", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "paslaugos-mokesciai.net", "domain": "paslaugos-mokesciai[.]net", "url": "hxxps://paslaugos-mokesciai[.]net", "category": "vmi", "brandGuess": "VMI", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "VirusTotal: 7 malicious / 0 suspicious (antivirusų reputacija).", "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": "US", "asn": "AS22612 US", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "vmi-mokesciai.com", "domain": "vmi-mokesciai[.]com", "url": "hxxps://vmi-mokesciai[.]com", "category": "vmi", "brandGuess": "VMI", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.", "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #D72CE1", "attributed": true, "hostingCountry": "RU", "asn": "AS200593 RU", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lt-vpm-mokesciai.net", "domain": "lt-vpm-mokesciai[.]net", "url": "hxxps://lt-vpm-mokesciai[.]net", "category": "vmi", "brandGuess": "VMI", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "VirusTotal: 3 malicious / 0 suspicious (antivirusų reputacija).", "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": null, "attributed": false, "hostingCountry": "RU", "asn": "AS57523 RU", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lt-vpa-mokesciai.net", "domain": "lt-vpa-mokesciai[.]net", "url": "hxxps://lt-vpa-mokesciai[.]net", "category": "vmi", "brandGuess": "VMI", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 1 kt. domenu.", "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": "Susijusi grupė #01EA2E", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "epaslaugos-mokesciai.com", "domain": "epaslaugos-mokesciai[.]com", "url": "hxxps://epaslaugos-mokesciai[.]com", "category": "vmi", "brandGuess": "VMI", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.", "Domene minimas „epaslaugos“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #D72CE1", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "kaandahauser.com", "domain": "kaandahauser[.]com", "url": "hxxps://kaandahauser[.]com", "category": "policija", "brandGuess": "Policija", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "baudasse-consulting.fr", "domain": "baudasse-consulting[.]fr", "url": "hxxps://baudasse-consulting[.]fr", "category": "policija", "brandGuess": "Policija", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „bauda“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "baudatenbank.ch", "domain": "baudatenbank[.]ch", "url": "hxxps://baudatenbank[.]ch", "category": "policija", "brandGuess": "Policija", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „bauda“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "cavin-baudat.ch", "domain": "cavin-baudat[.]ch", "url": "hxxps://cavin-baudat[.]ch", "category": "policija", "brandGuess": "Policija", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „bauda“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "baudossier.ch", "domain": "baudossier[.]ch", "url": "hxxps://baudossier[.]ch", "category": "policija", "brandGuess": "Policija", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.", "Domene minimas „baudos“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #2DEFE5", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "vminusizengimai-lt.net", "domain": "vminusizengimai-lt[.]net", "url": "hxxps://vminusizengimai-lt[.]net", "category": "policija", "brandGuess": "Policija", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „nusizengim“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lt-nusizengimai.net", "domain": "lt-nusizengimai[.]net", "url": "hxxps://lt-nusizengimai[.]net", "category": "policija", "brandGuess": "Policija", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 1 kt. domenu.", "Domene minimas „nusizengim“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #01EA2E", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "nusizengimuregistras.lt", "domain": "nusizengimuregistras[.]lt", "url": "hxxps://nusizengimuregistras[.]lt", "category": "policija", "brandGuess": "Policija", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „nusizengim“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "vmi.business", "domain": "vmi[.]business", "url": "hxxps://vmi[.]business", "category": "policija", "brandGuess": "Policija", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "com.ph", "domain": "com[.]ph", "url": "hxxps://com[.]ph", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu." ], "cluster": "Susijusi grupė #341EF5", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "swedbank.se", "domain": "swedbank[.]se", "url": "hxxps://swedbank[.]se", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „swedbank“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "luminor-kita.de", "domain": "luminor-kita[.]de", "url": "hxxps://luminor-kita[.]de", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „luminor“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "luminorbank.ph", "domain": "luminorbank[.]ph", "url": "hxxps://luminorbank[.]ph", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.", "Domene minimas „luminor“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #73FD77", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "autodealwordpress.com", "domain": "autodealwordpress[.]com", "url": "hxxps://autodealwordpress[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "pfox.app", "domain": "pfox[.]app", "url": "hxxps://pfox[.]app", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "luminorixa.com", "domain": "luminorixa[.]com", "url": "hxxps://luminorixa[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „luminor“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "qticketapp.com", "domain": "qticketapp[.]com", "url": "hxxps://qticketapp[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "luminor.sa", "domain": "luminor[.]sa", "url": "hxxps://luminor[.]sa", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „luminor“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "dkminingrevolut.io", "domain": "dkminingrevolut[.]io", "url": "hxxps://dkminingrevolut[.]io", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.", "Domene minimas „revolut“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #21F2F0", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "com.au", "domain": "com[.]au", "url": "hxxps://com[.]au", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "flossingrevolution.com", "domain": "flossingrevolution[.]com", "url": "hxxps://flossingrevolution[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.", "Domene minimas „revolut“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #21F2F0", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "revolutiongym.pl", "domain": "revolutiongym[.]pl", "url": "hxxps://revolutiongym[.]pl", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „revolut“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "edgeone.dev", "domain": "edgeone[.]dev", "url": "hxxps://edgeone[.]dev", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "mcas-df-gov.us", "domain": "mcas-df-gov[.]us", "url": "hxxps://mcas-df-gov[.]us", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "revolutionparts.io", "domain": "revolutionparts[.]io", "url": "hxxps://revolutionparts[.]io", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „revolut“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "smart-id.com", "domain": "smart-id[.]com", "url": "hxxps://smart-id[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "make-a-real-fashion-statement-with-one-of-these-smart-ideas.ph", "domain": "make-a-real-fashion-statement-with-one-of-these-smart-ideas[.]ph", "url": "hxxps://make-a-real-fashion-statement-with-one-of-these-smart-ideas[.]ph", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.", "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": "Susijusi grupė #73FD77", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "smart-identitysolutions.nl", "domain": "smart-identitysolutions[.]nl", "url": "hxxps://smart-identitysolutions[.]nl", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "com.cn", "domain": "com[.]cn", "url": "hxxps://com[.]cn", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "smartidentity.ro", "domain": "smartidentity[.]ro", "url": "hxxps://smartidentity[.]ro", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „smartid“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "pwc.de", "domain": "pwc[.]de", "url": "hxxps://pwc[.]de", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "smartidum.cz", "domain": "smartidum[.]cz", "url": "hxxps://smartidum[.]cz", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „smartid“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "09770532creditagricolebankasrbijaakcionarskodrustvonovi.ph", "domain": "09770532creditagricolebankasrbijaakcionarskodrustvonovi[.]ph", "url": "hxxps://09770532creditagricolebankasrbijaakcionarskodrustvonovi[.]ph", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.", "Domene minimas „bankas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #73FD77", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "org.ph", "domain": "org[.]ph", "url": "hxxps://org[.]ph", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu." ], "cluster": "Susijusi grupė #73FD77", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "net.ph", "domain": "net[.]ph", "url": "hxxps://net[.]ph", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu." ], "cluster": "Susijusi grupė #341EF5", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "2creditagricolebankasrbijaakcionarskodrustvonovi.ph", "domain": "2creditagricolebankasrbijaakcionarskodrustvonovi[.]ph", "url": "hxxps://2creditagricolebankasrbijaakcionarskodrustvonovi[.]ph", "category": "bankas", "brandGuess": "Bankas", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „bankas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "omnivar.rs", "domain": "omnivar[.]rs", "url": "hxxps://omnivar[.]rs", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "omnivaldata.com", "domain": "omnivaldata[.]com", "url": "hxxps://omnivaldata[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.", "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #3A2234", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "omnivaevents.com", "domain": "omnivaevents[.]com", "url": "hxxps://omnivaevents[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "omniva.ee", "domain": "omniva[.]ee", "url": "hxxps://omniva[.]ee", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "omnivana.com", "domain": "omnivana[.]com", "url": "hxxps://omnivana[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "omniva.tools", "domain": "omniva[.]tools", "url": "hxxps://omniva[.]tools", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "rlpexpress.es", "domain": "rlpexpress[.]es", "url": "hxxps://rlpexpress[.]es", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „lpexpress“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "alpexpressumzuege.de", "domain": "alpexpressumzuege[.]de", "url": "hxxps://alpexpressumzuege[.]de", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „lpexpress“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "vbm-helpexpress.eu", "domain": "vbm-helpexpress[.]eu", "url": "hxxps://vbm-helpexpress[.]eu", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „lpexpress“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "slpexpress.com", "domain": "slpexpress[.]com", "url": "hxxps://slpexpress[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.", "Domene minimas „lpexpress“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #14B660", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "help-express.hu", "domain": "help-express[.]hu", "url": "hxxps://help-express[.]hu", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „lp-express“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospastas.lt", "domain": "lietuvospastas[.]lt", "url": "hxxps://lietuvospastas[.]lt", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „lietuvospastas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "paketa.com", "domain": "paketa[.]com", "url": "hxxps://paketa[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospastas-paketa.com", "domain": "lietuvospastas-paketa[.]com", "url": "hxxps://lietuvospastas-paketa[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „lietuvospastas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospastas-lt.com", "domain": "lietuvospastas-lt[.]com", "url": "hxxps://lietuvospastas-lt[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „lietuvospastas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospastaslt.com", "domain": "lietuvospastaslt[.]com", "url": "hxxps://lietuvospastaslt[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „lietuvospastas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospost.ph", "domain": "lietuvospost[.]ph", "url": "hxxps://lietuvospost[.]ph", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.", "Domene minimas „lietuvospost“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #341EF5", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospost.com", "domain": "lietuvospost[.]com", "url": "hxxps://lietuvospost[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.", "Domene minimas „lietuvospost“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospost.rest", "domain": "lietuvospost[.]rest", "url": "hxxps://lietuvospost[.]rest", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.", "Domene minimas „lietuvospost“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #14B660", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "com.bo", "domain": "com[.]bo", "url": "hxxps://com[.]bo", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "deliverysol.com", "domain": "deliverysol[.]com", "url": "hxxps://deliverysol[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "scrummypastashop.com", "domain": "scrummypastashop[.]com", "url": "hxxps://scrummypastashop[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.", "Domene minimas „pastas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #078CC5", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "controlapps.ar", "domain": "controlapps[.]ar", "url": "hxxps://controlapps[.]ar", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "topadis-zahnpastaspender.de", "domain": "topadis-zahnpastaspender[.]de", "url": "hxxps://topadis-zahnpastaspender[.]de", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „pastas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "venipakmy.co", "domain": "venipakmy[.]co", "url": "hxxps://venipakmy[.]co", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.", "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #3A2234", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "m-venipak.co", "domain": "m-venipak[.]co", "url": "hxxps://m-venipak[.]co", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.", "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.", "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #3A2234", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "venipaki.lt", "domain": "venipaki[.]lt", "url": "hxxps://venipaki[.]lt", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "venipaks.lt", "domain": "venipaks[.]lt", "url": "hxxps://venipaks[.]lt", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "venipakmy.lt", "domain": "venipakmy[.]lt", "url": "hxxps://venipakmy[.]lt", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "venipakr.com", "domain": "venipakr[.]com", "url": "hxxps://venipakr[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "venipakn.com", "domain": "venipakn[.]com", "url": "hxxps://venipakn[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "dpd.lt", "domain": "dpd[.]lt", "url": "hxxps://dpd[.]lt", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "hmsiuntan.com", "domain": "hmsiuntan[.]com", "url": "hxxps://hmsiuntan[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „siunta“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "valpastas.com", "domain": "valpastas[.]com", "url": "hxxps://valpastas[.]com", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 2 kt. domenu.", "Domene minimas „pastas“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "Susijusi grupė #078CC5", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "thermofrontier.pt", "domain": "thermofrontier[.]pt", "url": "hxxps://thermofrontier[.]pt", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 2 kt. domenu." ], "cluster": "Susijusi grupė #078CC5", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "mokesciaiuk.blogspot.com", "domain": "mokesciaiuk[.]blogspot[.]com", "url": "hxxps://mokesciaiuk[.]blogspot[.]com", "category": "vmi", "brandGuess": "VMI", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "DE", "asn": "AS15169 DE", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "sso-edeklaravimas-mvm-sistema.web.app", "domain": "sso-edeklaravimas-mvm-sistema[.]web[.]app", "url": "hxxps://sso-edeklaravimas-mvm-sistema[.]web[.]app", "category": "vmi", "brandGuess": "VMI", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „edeklaravimas“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "sso-edeklaravimas-mvm-sistema.firebaseapp.com", "domain": "sso-edeklaravimas-mvm-sistema[.]firebaseapp[.]com", "url": "hxxps://sso-edeklaravimas-mvm-sistema[.]firebaseapp[.]com", "category": "vmi", "brandGuess": "VMI", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.", "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „edeklaravimas“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "baudadada.blogspot.com", "domain": "baudadada[.]blogspot[.]com", "url": "hxxps://baudadada[.]blogspot[.]com", "category": "policija", "brandGuess": "Policija", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „bauda“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "planodiretortibaudosul.blogspot.com", "domain": "planodiretortibaudosul[.]blogspot[.]com", "url": "hxxps://planodiretortibaudosul[.]blogspot[.]com", "category": "policija", "brandGuess": "Policija", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „baudos“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "swedbanklv-update.firebaseapp.com", "domain": "swedbanklv-update[.]firebaseapp[.]com", "url": "hxxps://swedbanklv-update[.]firebaseapp[.]com", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „swedbank“, nors tai ne oficialus tos įstaigos adresas." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "smart-identity-systems.pages.dev", "domain": "smart-identity-systems[.]pages[.]dev", "url": "hxxps://smart-identity-systems[.]pages[.]dev", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.", "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": "Susijusi grupė #2DEFE5", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "tabaja-smart-identity.pages.dev", "domain": "tabaja-smart-identity[.]pages[.]dev", "url": "hxxps://tabaja-smart-identity[.]pages[.]dev", "category": "bankas", "brandGuess": "Bankas", "status": "Stebimas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Žemas", "evidenceTier": "vardas", "reasonCodes": [ "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": null, "attributed": false, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "verify-smartident-io.pages.dev", "domain": "verify-smartident-io[.]pages[.]dev", "url": "hxxps://verify-smartident-io[.]pages[.]dev", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „smartid“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "verify-smartident-live.pages.dev", "domain": "verify-smartident-live[.]pages[.]dev", "url": "hxxps://verify-smartident-live[.]pages[.]dev", "category": "bankas", "brandGuess": "Bankas", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „smartid“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lp-expresspavingllc-com-19072026.pages.dev", "domain": "lp-expresspavingllc-com-19072026[.]pages[.]dev", "url": "hxxps://lp-expresspavingllc-com-19072026[.]pages[.]dev", "category": "siuntos", "brandGuess": "Paštas / kurjeris", "status": "Aktyvus", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 2, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Domene minimas „lp-express“, nors tai ne oficialus tos įstaigos adresas.", "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": null, "asn": null, "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] }, { "id": "lietuvospost.help", "domain": "lietuvospost[.]help", "url": "hxxps://lietuvospost[.]help", "category": "kita", "brandGuess": "Kita", "status": "Pašalintas", "firstSeen": "2026-08-29", "lastSeen": "2026-08-29", "matchScore": 0, "confidence": "Aukštas", "evidenceTier": "grupuote", "reasonCodes": [ "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.", "Pašto/kurjerio vardas + disposable galūnė.", "Reta, pigi galūnė .help — tokias mėgsta sukčiai." ], "cluster": "LT bankų cloak", "attributed": true, "hostingCountry": "UA", "asn": "AS48693 UA", "sources": [ "urlscan.io", "crt.sh", "RDAP", "Team Cymru" ] } ] }