{
  "type": "bundle",
  "id": "bundle--a880fcd5-430a-571c-b644-32e78603b326",
  "spec_version": "2.1",
  "x_cloudscout_notice": "Kiekvienas įrašas — pėdsakas (lead), ne nuosprendis. Domenai defanged (hxxps/[.]). Tik pasyvus OSINT iš viešų šaltinių; jokio skenavimo. Priskyrimas grupuotei — automatinis stebėjimas peržiūrai, ne teisinis įrodymas.",
  "x_cloudscout_generated_at": "2026-09-01T11:45:28+00:00",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--153a220c-489f-5284-ab8d-1333e9b1fa39",
      "name": "CloudScout Sukčių Radaras",
      "identity_class": "organization"
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--c9bc7e68-ec2d-5740-ac30-9823b22065bf",
      "value": "vcenix[.]info"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--4426b2a2-baa6-5d62-8bfc-b22989ec9792",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--c9bc7e68-ec2d-5740-ac30-9823b22065bf"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 11,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Reta, pigi galūnė .info — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--14480f98-5839-5318-8c6f-d9e91412babd",
      "value": "policija-gov[.]shop"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--255332bb-eef2-5cfb-b348-7471ecebc920",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--14480f98-5839-5318-8c6f-d9e91412babd"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno.",
        "Valdžios / baudos raktažodis + pigi galūnė.",
        "Reta, pigi galūnė .shop — tokias mėgsta sukčiai.",
        "Domenas labai naujas (18 d.) — dažna šviežių sukčių svetainių savybė."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--1bfce948-ede9-5807-ad17-4458ef7ee6a5",
      "value": "policija-gov-hr[.]lat"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--af99534a-de0e-5698-b992-da6a9b622595",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--1bfce948-ede9-5807-ad17-4458ef7ee6a5"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno.",
        "Valdžios / baudos raktažodis + pigi galūnė.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams.",
        "Reta, pigi galūnė .lat — tokias mėgsta sukčiai.",
        "Domenas labai naujas (12 d.) — dažna šviežių sukčių svetainių savybė."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--1dac7178-bf6f-5a12-9aaf-93670f6314c2",
      "value": "sercerto[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--e3ce1bcb-6ef8-52ec-98ef-a8a57f3fc7a0",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--1dac7178-bf6f-5a12-9aaf-93670f6314c2"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.",
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--adfd51ca-2db5-590a-b84a-15c2c2567855",
      "value": "ardenixs[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--a9b3859c-47f6-585a-a6f6-b2f65b79c72a",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--adfd51ca-2db5-590a-b84a-15c2c2567855"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--926867be-6d66-59ac-85ac-527184554cb4",
      "value": "swegenix[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--94101738-1132-5040-8839-87c87b601376",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--926867be-6d66-59ac-85ac-527184554cb4"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--e6cbbbd0-2194-5440-b178-71d05a743445",
      "value": "sierraelevate[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--55af5024-a0cb-5dbb-a9ab-9db223c93597",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--e6cbbbd0-2194-5440-b178-71d05a743445"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--d6c240e8-bf9e-5f15-b015-417d8698944e",
      "value": "avehicule[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--7860a2dd-bd3e-51aa-b275-b68a4935a007",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--d6c240e8-bf9e-5f15-b015-417d8698944e"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--f76c48c3-19b5-5561-9dda-179dfa7ba816",
      "value": "stalravia[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--bc41e77e-6ce9-5182-8ca9-ede0efa8f12d",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--f76c48c3-19b5-5561-9dda-179dfa7ba816"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--baa91701-7292-5423-aaef-d3abb34f55ac",
      "value": "clearpath-services[.]net"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--c376eb27-0611-5c2c-b116-72b97351066e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--baa91701-7292-5423-aaef-d3abb34f55ac"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--54f7f129-4e00-550e-92ff-bb3621aead88",
      "value": "clasped-log[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--89442ae5-7915-5a86-83c3-b81e95175ecf",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--54f7f129-4e00-550e-92ff-bb3621aead88"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "VirusTotal: 2 malicious / 2 suspicious (antivirusų reputacija).",
        "Turinys ar infrastruktūra atitinka žinomos sukčių grupuotės („kit“) parašą."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--c5cce38c-6674-5cf5-a5fd-0be61b3c23e1",
      "value": "blueelm[.]website"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--5423a103-7708-5312-be86-a1d2d8fd6008",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--c5cce38c-6674-5cf5-a5fd-0be61b3c23e1"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "VirusTotal: 3 malicious / 2 suspicious (antivirusų reputacija).",
        "Turinys ar infrastruktūra atitinka žinomos sukčių grupuotės („kit“) parašą.",
        "Reta, pigi galūnė .website — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--3cd79bff-115d-5cc3-b9ec-7bd4b510ebad",
      "value": "08-27[.]digital"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--ebaadba5-1237-5a1d-b806-38b3e229cb19",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-30T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--3cd79bff-115d-5cc3-b9ec-7bd4b510ebad"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 9,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Data pavadinime + pigi galūnė — „administracinės baudos“ schema (kaip 28-08.digital).",
        "Reta, pigi galūnė .digital — tokias mėgsta sukčiai.",
        "Domenas labai naujas (0 d.) — dažna šviežių sukčių svetainių savybė."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--2a1d4bfe-480d-5525-854d-fc761e43f697",
      "value": "drstellanet[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--3bd106e4-caa0-5108-856a-dd82df1a41ac",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--2a1d4bfe-480d-5525-854d-fc761e43f697"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 7,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Lucid (XinXin grupė)",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 12 kt. domenu; tas pats kit kaip žinomo „lucid“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--cc6936f2-05a0-5703-8813-8e8eb2977cdc",
      "value": "elmridges[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b33970a4-a8a7-5471-a5d2-2d7f7436109e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--cc6936f2-05a0-5703-8813-8e8eb2977cdc"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 7,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--43f70b0c-1faf-5018-929a-c30618d51c32",
      "value": "solettu[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--4477d03c-e9c9-5b6d-a1aa-76a038950b27",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--43f70b0c-1faf-5018-929a-c30618d51c32"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 7,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--8e78c4bb-1322-5c8d-9c63-f1b25758de94",
      "value": "syntricapp[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--abc8e3af-4c75-55f2-bcc3-f66be490f9b4",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--8e78c4bb-1322-5c8d-9c63-f1b25758de94"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 7,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--857b49cd-3fba-510b-a13e-e9669c59f0e7",
      "value": "hostastra8[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b1ac43ed-9e97-52d1-9d46-73c95d90c402",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--857b49cd-3fba-510b-a13e-e9669c59f0e7"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 7,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--3232e14e-0e52-50b3-9587-e0ecfd6da98d",
      "value": "nseventure[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--0aeff4a7-497c-5919-be7b-9d62c000cb9b",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--3232e14e-0e52-50b3-9587-e0ecfd6da98d"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 6,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.",
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--b88950c9-f941-5089-81ff-977d03c8a43b",
      "value": "www[.]netflix-login[.]blogspot[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--1d749573-a273-590e-86bf-bb700486f272",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--b88950c9-f941-5089-81ff-977d03c8a43b"
      ],
      "x_cloudscout_category": "eshop",
      "x_cloudscout_brand": "Parduotuvė",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 5,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „netflix“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--d7e429f7-55d3-5235-a3f3-9b3676bcdf4c",
      "value": "prisijungti-esodra[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--8ea94b91-2ff4-5763-9604-6028ce55eb75",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-30T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--d7e429f7-55d3-5235-a3f3-9b3676bcdf4c"
      ],
      "x_cloudscout_category": "sodra",
      "x_cloudscout_brand": "Sodra",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 5,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Sodros raktažodis + neįprasta galūnė.",
        "Domenas labai naujas (0 d.) — dažna šviežių sukčių svetainių savybė."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4490058a-dc61-5a5f-9def-9c0239903e44",
      "value": "epaslaugos[.]icu"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--9dd1a3bf-1ded-5994-b8a5-13399b193166",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4490058a-dc61-5a5f-9def-9c0239903e44"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „epaslaugos“, nors tai ne oficialus tos įstaigos adresas.",
        "Reta, pigi galūnė .icu — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--5388ced7-da26-5175-b527-2ab66a4def45",
      "value": "uull2policija[.]online"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f9732888-df58-5af7-a286-9effdbd235c7",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--5388ced7-da26-5175-b527-2ab66a4def45"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Valdžios / baudos raktažodis + pigi galūnė.",
        "Reta, pigi galūnė .online — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--494bfc4b-60a9-5f2a-adef-f568b16661df",
      "value": "sveikatosprotokolas[.]online"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--1729cfca-7b80-5cac-99fe-4bc811acbce6",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--494bfc4b-60a9-5f2a-adef-f568b16661df"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Vidutinis",
      "x_cloudscout_evidence_tier": "patvirtinta",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Valdžios / baudos raktažodis + pigi galūnė.",
        "Reta, pigi galūnė .online — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--9c04d719-1cd5-599a-81db-9e7eb19cfc1f",
      "value": "aprilljonsonsmartidhk[.]click"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--d7e4df5e-e478-58ca-98c8-a2271aa00d59",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--9c04d719-1cd5-599a-81db-9e7eb19cfc1f"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Vidutinis",
      "x_cloudscout_evidence_tier": "patvirtinta",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Banko vardas + neįprasta galūnė.",
        "Reta, pigi galūnė .click — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--31e545bd-83ef-5433-9657-7ece2ca5514a",
      "value": "omniva[.]online"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--bca1e7c0-c5d0-506b-8fed-754ef77d183d",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--31e545bd-83ef-5433-9657-7ece2ca5514a"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Vidutinis",
      "x_cloudscout_evidence_tier": "patvirtinta",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Pašto/kurjerio vardas + disposable galūnė.",
        "Reta, pigi galūnė .online — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--ccbda3a1-428c-5e18-a984-a4d603dfb71f",
      "value": "clpexpress[.]top"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--e404e547-71df-5cea-86c6-bda1faaee55d",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--ccbda3a1-428c-5e18-a984-a4d603dfb71f"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Pašto/kurjerio vardas + disposable galūnė.",
        "Reta, pigi galūnė .top — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--e38f5897-7324-527d-894f-1d71b5bd9f44",
      "value": "vitaglp-express[.]shop"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f6c31ea6-6dae-558f-9a62-bcaa30852241",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--e38f5897-7324-527d-894f-1d71b5bd9f44"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „lp-express“, nors tai ne oficialus tos įstaigos adresas.",
        "Reta, pigi galūnė .shop — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--bcd166ad-db48-5fe6-af4b-8f07cb5402b5",
      "value": "flp-express[.]online"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--22a03d2b-b8a1-5b92-a119-2d5f1474eb77",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--bcd166ad-db48-5fe6-af4b-8f07cb5402b5"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #0878FB",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.",
        "Pašto/kurjerio vardas + disposable galūnė.",
        "Reta, pigi galūnė .online — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--05be6f01-0bf5-5ce2-97b2-0babd3aa5f85",
      "value": "lietuvospost[.]icu"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--501705ab-6425-5f62-8f9c-02e3f0824452",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--05be6f01-0bf5-5ce2-97b2-0babd3aa5f85"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #14B660",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.",
        "Pašto/kurjerio vardas + disposable galūnė.",
        "Reta, pigi galūnė .icu — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--92967860-0250-55b9-8ba9-05332db3fe9c",
      "value": "esiunta[.]help"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--d85764e8-8243-5e6a-860d-88698559e471",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--92967860-0250-55b9-8ba9-05332db3fe9c"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Vidutinis",
      "x_cloudscout_evidence_tier": "patvirtinta",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Pašto/kurjerio vardas + disposable galūnė.",
        "Reta, pigi galūnė .help — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--a38ebaa4-22d0-5b28-b8ac-1a68390fada9",
      "value": "ap-epaslaugos[.]lat"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--d6ac30bf-f5cf-52ff-84c5-9f3e31e5626c",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--a38ebaa4-22d0-5b28-b8ac-1a68390fada9"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Valdžios / baudos raktažodis + pigi galūnė.",
        "Reta, pigi galūnė .lat — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--c44e3293-8ab0-5c21-b988-29267ec81ce5",
      "value": "lt-mokesciai[.]info"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--2210fcdf-f3c1-51b2-9047-8797ed0f378c",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--c44e3293-8ab0-5c21-b988-29267ec81ce5"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "VirusTotal: 6 malicious / 0 suspicious (antivirusų reputacija).",
        "VMI raktažodis + pigi galūnė.",
        "Reta, pigi galūnė .info — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--71feb5b1-23b5-5740-a369-3c809b6ac1f8",
      "value": "dokumntpolicija[.]info"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--2500de05-5803-52b7-ad22-7a4b1acff0fc",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--71feb5b1-23b5-5740-a369-3c809b6ac1f8"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Vidutinis",
      "x_cloudscout_evidence_tier": "patvirtinta",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Valdžios / baudos raktažodis + pigi galūnė.",
        "Reta, pigi galūnė .info — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--15a3303a-5c3c-5970-b270-d3c022d4e24c",
      "value": "nuobaudos-e-poli[.]info"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--c32a74f7-d70e-5e7b-b5d2-5b852a6b9819",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--15a3303a-5c3c-5970-b270-d3c022d4e24c"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #3A2234",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.",
        "Valdžios / baudos raktažodis + pigi galūnė.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams.",
        "Reta, pigi galūnė .info — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--dac3dedd-4441-5f54-9569-7aff07c5d1e8",
      "value": "vaizdas-patvirtinti-sesija[.]info"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--13c27506-69f6-5d75-b6e6-5110cbd7be8a",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--dac3dedd-4441-5f54-9569-7aff07c5d1e8"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Vidutinis",
      "x_cloudscout_evidence_tier": "patvirtinta",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams.",
        "Reta, pigi galūnė .info — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--8500e4fb-f292-504f-b057-e679deec02b5",
      "value": "co[.]uk"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--540de203-9073-585e-a842-d856b111111e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--8500e4fb-f292-504f-b057-e679deec02b5"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--19a91adf-7fd8-5cb3-9474-dfe78b2e9590",
      "value": "lietuvospost[.]lat"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--2c5ce328-6f54-5177-8ffa-15566090760c",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--19a91adf-7fd8-5cb3-9474-dfe78b2e9590"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #0878FB",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.",
        "Domene minimas „lietuvospost“, nors tai ne oficialus tos įstaigos adresas.",
        "Reta, pigi galūnė .lat — tokias mėgsta sukčiai."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--84a56269-d3c1-5f0d-bd71-2a5e0d069699",
      "value": "servionel[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--2b8f8f68-a5a1-56c2-9997-d8c6f426db85",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--84a56269-d3c1-5f0d-bd71-2a5e0d069699"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--226971e1-b1b3-51c4-9443-511799c07559",
      "value": "codesaturno[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--ac23945b-ca4b-5811-b23c-e6b7328909ad",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--226971e1-b1b3-51c4-9443-511799c07559"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "VirusTotal: 9 malicious / 0 suspicious (antivirusų reputacija)."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--18f0e758-3599-5304-a206-367986af622b",
      "value": "data-ivy[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--65e79131-b42c-5fb4-ba6b-24fd57d85eb6",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--18f0e758-3599-5304-a206-367986af622b"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--46c95378-12ab-519b-9c34-f5acba0b2aff",
      "value": "maxibrant[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--1cf428ae-7408-58c4-b86b-4bb3c804a062",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--46c95378-12ab-519b-9c34-f5acba0b2aff"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 4,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--b4f5219d-28b3-5286-b183-b96979d09773",
      "value": "paslaugos-mokesciai[.]net"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--e62cd96d-78d6-51dc-bcaa-93540d21bb27",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--b4f5219d-28b3-5286-b183-b96979d09773"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "VirusTotal: 7 malicious / 0 suspicious (antivirusų reputacija).",
        "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--49dffce8-404f-57d6-b0d3-2ffcd5a1b494",
      "value": "vmi-mokesciai[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--fe68bf20-3a82-5d82-a330-d8c431bc2ce0",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--49dffce8-404f-57d6-b0d3-2ffcd5a1b494"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #D72CE1",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.",
        "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--5a498f1d-b010-557f-aba0-bbad166f942a",
      "value": "lt-vpm-mokesciai[.]net"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--4667a5c7-c776-51fd-8ca1-6858e2abcb46",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--5a498f1d-b010-557f-aba0-bbad166f942a"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "VirusTotal: 3 malicious / 0 suspicious (antivirusų reputacija).",
        "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--fd8ef717-8dc0-559f-aea1-f1e4a6ee3246",
      "value": "lt-vpa-mokesciai[.]net"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--7791d04b-9037-5253-8cea-132c9dd35f41",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--fd8ef717-8dc0-559f-aea1-f1e4a6ee3246"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #01EA2E",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 1 kt. domenu.",
        "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--21fda6dd-eb5d-5204-b512-9b534131b33f",
      "value": "epaslaugos-mokesciai[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b8dc8746-d133-50ab-80d8-6a6d33c094fd",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--21fda6dd-eb5d-5204-b512-9b534131b33f"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #D72CE1",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.",
        "Domene minimas „epaslaugos“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--f5c6a2d0-7b84-5417-920f-0a33bb959295",
      "value": "kaandahauser[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--0ea1cdb9-d1b2-5405-901f-a59880a9e01f",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--f5c6a2d0-7b84-5417-920f-0a33bb959295"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--2cf4f8ae-7191-560f-9241-9a2de92f6c77",
      "value": "baudasse-consulting[.]fr"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b28e0106-9f8e-5e73-8667-c00585937231",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--2cf4f8ae-7191-560f-9241-9a2de92f6c77"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „bauda“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--7cf770dc-e475-58a7-b629-b511851ba2e6",
      "value": "baudatenbank[.]ch"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--7eb763ff-8c3b-5f98-b57d-80482f0dfba7",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--7cf770dc-e475-58a7-b629-b511851ba2e6"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „bauda“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--0b5109e9-f7a5-52eb-96e6-5af2cb431eca",
      "value": "cavin-baudat[.]ch"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--44185060-dc80-5692-a907-b121e2404787",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--0b5109e9-f7a5-52eb-96e6-5af2cb431eca"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „bauda“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--7f7d09af-b469-5329-9ae1-8887a4a7938d",
      "value": "baudossier[.]ch"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--efc6b723-5fc4-5810-b963-aca23150030f",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--7f7d09af-b469-5329-9ae1-8887a4a7938d"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #2DEFE5",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.",
        "Domene minimas „baudos“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--03803376-1af5-551c-b782-a131e432191a",
      "value": "vminusizengimai-lt[.]net"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--d8ec545f-b05d-544d-8007-5c83a65bdcb0",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--03803376-1af5-551c-b782-a131e432191a"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „nusizengim“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--0cd752d4-5af2-5558-b03a-f95fab7881a3",
      "value": "lt-nusizengimai[.]net"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--129c1d96-219c-52b0-9304-2f72e743d77c",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--0cd752d4-5af2-5558-b03a-f95fab7881a3"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #01EA2E",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 1 kt. domenu.",
        "Domene minimas „nusizengim“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--47e801e1-b21f-56cf-8958-25d56bbfba1f",
      "value": "nusizengimuregistras[.]lt"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--e2b4b2d9-218c-567b-b1cf-280ff8381410",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--47e801e1-b21f-56cf-8958-25d56bbfba1f"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „nusizengim“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--8c99a8a4-3f9d-5eaf-85f2-61ef6f772e3a",
      "value": "vmi[.]business"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--765480a8-7184-59b3-8cca-426780c6f387",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--8c99a8a4-3f9d-5eaf-85f2-61ef6f772e3a"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--e620ec1b-b484-5ea7-9157-013d43a18ec1",
      "value": "com[.]ph"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--5faa215c-c654-5738-a1a5-5319facfb6e3",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--e620ec1b-b484-5ea7-9157-013d43a18ec1"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #341EF5",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--ef852507-925c-591d-8d35-93391f33e5c0",
      "value": "swedbank[.]se"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--951a878a-d455-58b9-ad3d-d50b8d08990e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--ef852507-925c-591d-8d35-93391f33e5c0"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „swedbank“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4578a645-f6b8-54b2-99bb-1a58d90e822b",
      "value": "luminor-kita[.]de"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--0a0f2baf-2a21-5c2e-8eec-5e392a822791",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4578a645-f6b8-54b2-99bb-1a58d90e822b"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „luminor“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--94cecc86-9c20-5acd-8015-00fc82b46c3b",
      "value": "luminorbank[.]ph"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--fe27c3b0-616e-5457-8711-18f03613ceab",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--94cecc86-9c20-5acd-8015-00fc82b46c3b"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #73FD77",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.",
        "Domene minimas „luminor“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--b2a7deca-a2bc-57e1-b30c-94755b972a12",
      "value": "autodealwordpress[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--226c5449-7797-5f06-92d5-fcccc2ecce8f",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--b2a7deca-a2bc-57e1-b30c-94755b972a12"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--bdc56ed0-190d-5fdd-8622-44ff9c8e418c",
      "value": "pfox[.]app"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f36b45d0-dae7-51ff-bb20-b88f1d8d3ec4",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--bdc56ed0-190d-5fdd-8622-44ff9c8e418c"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--7b1c868b-5d0b-5450-8567-40556cb643b8",
      "value": "luminorixa[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--01f47acc-ddf7-550c-af54-1e4861ad9270",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--7b1c868b-5d0b-5450-8567-40556cb643b8"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „luminor“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--fa58c1a2-1811-5015-af92-cf29ad1da8de",
      "value": "qticketapp[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b11c20c3-a0a9-548a-a6ea-a8332dad66c3",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--fa58c1a2-1811-5015-af92-cf29ad1da8de"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--d8703c63-3bec-540f-9e87-f3d38a4dfa52",
      "value": "luminor[.]sa"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f8d22fb5-0ba4-5d6f-a796-e256100aa5a5",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--d8703c63-3bec-540f-9e87-f3d38a4dfa52"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „luminor“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--89b4549f-c3ad-5434-9c04-ce806190fa81",
      "value": "dkminingrevolut[.]io"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--4237c80a-2a01-5f54-a0e1-15afe1d1e99e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--89b4549f-c3ad-5434-9c04-ce806190fa81"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #21F2F0",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.",
        "Domene minimas „revolut“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--62d4caa8-c9d6-5c8e-8581-2ae621eab613",
      "value": "com[.]au"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--583f0bd1-b24a-5d5f-8f9a-84052fbe26cf",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--62d4caa8-c9d6-5c8e-8581-2ae621eab613"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": []
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--de20ebc7-d565-56d3-a0b2-b384c227d7a1",
      "value": "flossingrevolution[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--8b8f5450-9d0c-5ac7-bc2a-89ae8dbd7cf3",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--de20ebc7-d565-56d3-a0b2-b384c227d7a1"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #21F2F0",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 1 kt. domenu.",
        "Domene minimas „revolut“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--88f68e93-43ab-59d0-8aa9-99470706e31e",
      "value": "revolutiongym[.]pl"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--bbb71e05-71bc-50cf-9105-85be91239009",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--88f68e93-43ab-59d0-8aa9-99470706e31e"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „revolut“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--cda23edf-95aa-5a7c-8de3-e4e8b047dbb7",
      "value": "edgeone[.]dev"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--a0e6d424-f743-5c9a-88a9-a6807997001b",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--cda23edf-95aa-5a7c-8de3-e4e8b047dbb7"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": []
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--ec387ab6-ef90-52f3-8c38-ca927965e435",
      "value": "mcas-df-gov[.]us"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--acf07504-f154-5b1e-bee7-80838be8e0d4",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--ec387ab6-ef90-52f3-8c38-ca927965e435"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4bb3cbf1-a088-59cd-a755-f1415e306005",
      "value": "revolutionparts[.]io"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f408e373-f468-50e4-b5ea-3e4e10166c79",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4bb3cbf1-a088-59cd-a755-f1415e306005"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „revolut“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--34064400-9875-54eb-b463-a7529ed05a45",
      "value": "smart-id[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--a8e2f6a7-e7be-5633-8420-67e8427868a7",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--34064400-9875-54eb-b463-a7529ed05a45"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--bc9522b3-caa4-5d6a-bf6b-9b15e2deef05",
      "value": "make-a-real-fashion-statement-with-one-of-these-smart-ideas[.]ph"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--01415c7f-6fea-56bb-b423-61737028b888",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--bc9522b3-caa4-5d6a-bf6b-9b15e2deef05"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #73FD77",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.",
        "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--629bba5d-c28f-5d0b-a01b-d73b49e50610",
      "value": "smart-identitysolutions[.]nl"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--6d87a944-e315-52b3-b4ed-429b5d736d9b",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--629bba5d-c28f-5d0b-a01b-d73b49e50610"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--02422240-e36f-51b9-9e4b-a036e5443901",
      "value": "com[.]cn"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--a227ec7d-a77d-5d88-b3ee-2db40d0718ed",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--02422240-e36f-51b9-9e4b-a036e5443901"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": []
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--2965c963-3254-5df9-b203-6b39ded2cfbe",
      "value": "smartidentity[.]ro"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b7b1e925-c827-50b5-a695-9125c0c8ebc2",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--2965c963-3254-5df9-b203-6b39ded2cfbe"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „smartid“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4c9a11bf-5e9f-56f3-8505-e7c25da6bd54",
      "value": "pwc[.]de"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--4ac1e8ac-4a42-57e7-b17c-94da15cec462",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4c9a11bf-5e9f-56f3-8505-e7c25da6bd54"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": []
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--587f96ec-4dd5-526c-94d1-144636f83c42",
      "value": "smartidum[.]cz"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--cb191c77-a3c3-58a0-ace5-11c9e9345c3e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--587f96ec-4dd5-526c-94d1-144636f83c42"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „smartid“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--35a2bad0-5c39-5989-bb03-7b3d50d4058e",
      "value": "09770532creditagricolebankasrbijaakcionarskodrustvonovi[.]ph"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--4e395b70-2111-50df-ae87-4537706703d5",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--35a2bad0-5c39-5989-bb03-7b3d50d4058e"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #73FD77",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.",
        "Domene minimas „bankas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--ad280859-1615-5f9a-a849-651fcf1a571e",
      "value": "org[.]ph"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f1e6680a-c615-5cfb-bb58-9ab6937fec01",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--ad280859-1615-5f9a-a849-651fcf1a571e"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #73FD77",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--da66b8b8-c0a2-5e0c-993b-8c4f4054a9ac",
      "value": "net[.]ph"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--7105b9dd-a3a7-57a5-9aef-657721d191ab",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--da66b8b8-c0a2-5e0c-993b-8c4f4054a9ac"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #341EF5",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--01006387-a883-52ab-824d-c7172cc39b4d",
      "value": "2creditagricolebankasrbijaakcionarskodrustvonovi[.]ph"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--67b1dca7-3d4f-58b9-9fe9-990f88f42f3a",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--01006387-a883-52ab-824d-c7172cc39b4d"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „bankas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--fad9a347-d9cf-5d80-b29c-632506c57e10",
      "value": "omnivar[.]rs"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b0301200-6d94-523c-9bf3-d7886ce573cc",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--fad9a347-d9cf-5d80-b29c-632506c57e10"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--74c8664d-2e37-59d3-8f92-cfdbe669aa99",
      "value": "omnivaldata[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--8205088b-7530-5242-a1dd-13d0132ac198",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--74c8664d-2e37-59d3-8f92-cfdbe669aa99"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #3A2234",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.",
        "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--d7129f76-0e34-54eb-909b-0f2b277e0479",
      "value": "omnivaevents[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--e2c4b215-7c85-55a2-8d32-bef2d01eeb45",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--d7129f76-0e34-54eb-909b-0f2b277e0479"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4e6a6bcd-7253-566f-8048-0cf84713fd21",
      "value": "omniva[.]ee"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--1cdc0116-9ab0-56d0-9b43-022bcc40031b",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4e6a6bcd-7253-566f-8048-0cf84713fd21"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--49fc8c14-5c0a-523b-a430-2b98c193652f",
      "value": "omnivana[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--ac62abab-7cd3-5c97-8635-82d284305026",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--49fc8c14-5c0a-523b-a430-2b98c193652f"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--5410175b-1ec6-596d-9f03-c7ad226966e3",
      "value": "omniva[.]tools"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--53a9f2a6-844f-55c0-9d8f-2ee65d7ee482",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--5410175b-1ec6-596d-9f03-c7ad226966e3"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „omniva“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--f887950c-eea0-58bf-b281-b536a027293f",
      "value": "rlpexpress[.]es"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--87d5fe9a-c417-54f3-a49c-68109366f2ef",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--f887950c-eea0-58bf-b281-b536a027293f"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „lpexpress“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--5cec659f-84fa-5ca2-809d-bfd0818f8ae9",
      "value": "alpexpressumzuege[.]de"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--db590d2b-75f8-5017-b0eb-3b80d38521a7",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--5cec659f-84fa-5ca2-809d-bfd0818f8ae9"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „lpexpress“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--bae2a3c1-afcc-5c6a-b2ce-2d4b3a01f12f",
      "value": "vbm-helpexpress[.]eu"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b530840b-f11e-5673-a0bd-8d05633c2180",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--bae2a3c1-afcc-5c6a-b2ce-2d4b3a01f12f"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „lpexpress“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--bcf93d5b-f26e-599a-a13f-858397f79b32",
      "value": "slpexpress[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--c8a2d90d-b32e-5c81-92d8-24e5b66f0e90",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--bcf93d5b-f26e-599a-a13f-858397f79b32"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #14B660",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.",
        "Domene minimas „lpexpress“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--caaa3ea7-9109-56bf-9a27-021adef13bab",
      "value": "help-express[.]hu"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f8ed5f0e-e3f0-5310-8a18-695a86440638",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--caaa3ea7-9109-56bf-9a27-021adef13bab"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „lp-express“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--abbb1852-d9a8-5c6d-a0b0-d2d877fffb50",
      "value": "lietuvospastas[.]lt"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--3c477b97-5263-5a71-8dfa-abbad764aea5",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--abbb1852-d9a8-5c6d-a0b0-d2d877fffb50"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „lietuvospastas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--e5e28aad-979a-501d-bd8d-ea02ccf52efb",
      "value": "paketa[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--222c7ebc-78ff-53b6-9924-8c745c07df5f",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--e5e28aad-979a-501d-bd8d-ea02ccf52efb"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": []
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--07eba1d6-2213-5b12-b6fb-1013cff586ba",
      "value": "lietuvospastas-paketa[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f12a951b-c565-5b9c-85a7-b1d5f4ac6ae6",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--07eba1d6-2213-5b12-b6fb-1013cff586ba"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „lietuvospastas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--c955b65c-471c-5143-b662-4b641abbcebf",
      "value": "lietuvospastas-lt[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--6e96035f-f6f1-5847-ab7d-45c761910005",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--c955b65c-471c-5143-b662-4b641abbcebf"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „lietuvospastas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--66eb3fcb-2832-5e32-bf7a-76cdb3229a51",
      "value": "lietuvospastaslt[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--db245734-bba6-5c0d-87a6-9c047d257015",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--66eb3fcb-2832-5e32-bf7a-76cdb3229a51"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 4 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „lietuvospastas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--390a7b9f-bf03-5ed6-9535-1c3d3825489f",
      "value": "lietuvospost[.]ph"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--6ba6e658-8aa6-5898-8a2f-730a813b2e07",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--390a7b9f-bf03-5ed6-9535-1c3d3825489f"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #341EF5",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.",
        "Domene minimas „lietuvospost“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--7a5994fc-4ef8-5958-aae0-d713c984ff0c",
      "value": "lietuvospost[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--2d5a75c8-44a8-5dfb-a2ab-fb13666f1b97",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--7a5994fc-4ef8-5958-aae0-d713c984ff0c"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.",
        "Domene minimas „lietuvospost“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--677079d5-1e30-571e-acc3-49848e046433",
      "value": "lietuvospost[.]rest"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--6727027e-dbdb-5288-80ae-89ff27a68288",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--677079d5-1e30-571e-acc3-49848e046433"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #14B660",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.",
        "Domene minimas „lietuvospost“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--0ec4e89a-c74b-5d5b-a516-ee275e8b7631",
      "value": "com[.]bo"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--211b4b33-966d-5f0a-b0ea-99096e45aa7e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--0ec4e89a-c74b-5d5b-a516-ee275e8b7631"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": []
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--f98a6b43-30c6-51f9-9a06-9d8cc3262e68",
      "value": "deliverysol[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--8520a941-e84b-50c5-8df4-af83b60d2822",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--f98a6b43-30c6-51f9-9a06-9d8cc3262e68"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--2fc28f14-62c6-56a0-9096-9a3aab004177",
      "value": "scrummypastashop[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--20254107-115d-5790-8fa3-af7caa7bd995",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--2fc28f14-62c6-56a0-9096-9a3aab004177"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #078CC5",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.",
        "Domene minimas „pastas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--de1f0a21-1b03-5e5b-a2d4-cfaedf6b8a9e",
      "value": "controlapps[.]ar"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--57bca8dc-0e2b-595e-9f8c-6d73f6f0b291",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--de1f0a21-1b03-5e5b-a2d4-cfaedf6b8a9e"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": []
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--2399db3a-2219-586b-8adf-ad78b24ee1ec",
      "value": "topadis-zahnpastaspender[.]de"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--8bd6a7ad-7549-50e5-96cf-de40a5efd1f1",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--2399db3a-2219-586b-8adf-ad78b24ee1ec"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „pastas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--b3a1f959-babd-5507-8dae-65a1d120ada7",
      "value": "venipakmy[.]co"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--03a1b0f4-e472-5c9d-891a-493229447b33",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--b3a1f959-babd-5507-8dae-65a1d120ada7"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #3A2234",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.",
        "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4ce3a7bb-af3c-5734-a2e3-a8561c1066c1",
      "value": "m-venipak[.]co"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--97406a05-9e36-58cb-bf6e-36ac3648dcec",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4ce3a7bb-af3c-5734-a2e3-a8561c1066c1"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #3A2234",
      "x_cloudscout_reason_codes": [
        "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.",
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 3 kt. domenu.",
        "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--08e50b62-538a-5acd-a887-f8c96e07030f",
      "value": "venipaki[.]lt"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--0ccd19fd-9dda-52e5-97e4-16e35c67ed36",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--08e50b62-538a-5acd-a887-f8c96e07030f"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--3df36eae-d798-5562-a1bf-9d2a0f97e4e2",
      "value": "venipaks[.]lt"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--55ee44a1-53d9-5719-8778-8d8d806877ef",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--3df36eae-d798-5562-a1bf-9d2a0f97e4e2"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--1453c219-c69f-541b-8ba4-eab03cec5e01",
      "value": "venipakmy[.]lt"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--a361ae32-6659-51d5-8180-ad338ca51471",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--1453c219-c69f-541b-8ba4-eab03cec5e01"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--09340838-c5a0-52a3-ba1b-2a3991950028",
      "value": "venipakr[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--210eaa34-2d88-5dae-ab3a-6f4fc0184f15",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--09340838-c5a0-52a3-ba1b-2a3991950028"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--a6732fbc-453f-56da-8272-ea6adca768d3",
      "value": "venipakn[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--b68be33a-75e6-575b-af21-ccff8e17df0d",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--a6732fbc-453f-56da-8272-ea6adca768d3"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „venipak“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--0cdfd784-4688-5270-995c-93bd11f2d49c",
      "value": "dpd[.]lt"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--823398a3-b428-5ed3-8298-0a3d20deb892",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--0cdfd784-4688-5270-995c-93bd11f2d49c"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--984e44e2-08cd-5a1e-92a8-67836b36d80e",
      "value": "hmsiuntan[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--4c008c3b-b324-587f-99fd-bfdf32ca7822",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--984e44e2-08cd-5a1e-92a8-67836b36d80e"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „siunta“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--16d2a414-1c08-5c02-a9a9-294fbb536185",
      "value": "valpastas[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--7f099965-f2aa-55e4-8853-b3240d1b7870",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--16d2a414-1c08-5c02-a9a9-294fbb536185"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #078CC5",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 2 kt. domenu.",
        "Domene minimas „pastas“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--b8980a8f-15da-5997-9c0a-1ed4e78971df",
      "value": "thermofrontier[.]pt"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--81fc0de9-316f-51f8-af12-e3bb9695fb7e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--b8980a8f-15da-5997-9c0a-1ed4e78971df"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #078CC5",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 2 kt. domenu."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--1ef251b9-a3d4-5e88-9fa7-37c4ca4b77b4",
      "value": "mokesciaiuk[.]blogspot[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--45fd1698-54fa-5229-b3e2-a51315da18ee",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--1ef251b9-a3d4-5e88-9fa7-37c4ca4b77b4"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „mokesciai“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--869338ee-94dd-5baf-9f01-a1f7df19f0b3",
      "value": "sso-edeklaravimas-mvm-sistema[.]web[.]app"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--407d6cd8-2511-546d-912a-1740057aa11e",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--869338ee-94dd-5baf-9f01-a1f7df19f0b3"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras form-action backend su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „edeklaravimas“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--c9a59586-638b-5db7-8a7a-92852099e1cf",
      "value": "sso-edeklaravimas-mvm-sistema[.]firebaseapp[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--f7d85bc6-ccfe-5f60-8193-984d33c0ec47",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--c9a59586-638b-5db7-8a7a-92852099e1cf"
      ],
      "x_cloudscout_category": "vmi",
      "x_cloudscout_brand": "VMI",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Google Safe Browsing pažymėjo kenksmingu (phishing (apgaulė)) — naršyklės tai jau blokuoja.",
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „edeklaravimas“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4296cb73-0500-5e4b-b60a-dcc75ff93586",
      "value": "baudadada[.]blogspot[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--9ed443a6-e6aa-5438-b46a-08e4fdd67406",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4296cb73-0500-5e4b-b60a-dcc75ff93586"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „bauda“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4a560076-f402-52af-b6ca-c871e5562482",
      "value": "planodiretortibaudosul[.]blogspot[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--9c9a2dfb-7e8c-54d8-a1de-fb1db43aacdd",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4a560076-f402-52af-b6ca-c871e5562482"
      ],
      "x_cloudscout_category": "policija",
      "x_cloudscout_brand": "Policija",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „baudos“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--4501b7ac-1e71-5e85-ab57-037b731f5c61",
      "value": "swedbanklv-update[.]firebaseapp[.]com"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--e55c7735-2223-5e76-add6-61bb8baa62f0",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--4501b7ac-1e71-5e85-ab57-037b731f5c61"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „swedbank“, nors tai ne oficialus tos įstaigos adresas."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--8443a0b3-8707-5064-8a54-6cffe992f16f",
      "value": "smart-identity-systems[.]pages[.]dev"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--99ddce48-44e2-552e-b8d5-f077fef72a81",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--8443a0b3-8707-5064-8a54-6cffe992f16f"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "Susijusi grupė #2DEFE5",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 2 kt. domenu.",
        "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--803fd067-86ef-5a6a-9022-ab67c38a40b8",
      "value": "tabaja-smart-identity[.]pages[.]dev"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--eb9bc872-0b90-5906-9a5b-dc2238c8af21",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--803fd067-86ef-5a6a-9022-ab67c38a40b8"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Stebimas",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Žemas",
      "x_cloudscout_evidence_tier": "vardas",
      "x_cloudscout_cluster": null,
      "x_cloudscout_reason_codes": [
        "Domene minimas „smart-id“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--1fd86470-9927-56a0-8326-28506b219033",
      "value": "verify-smartident-io[.]pages[.]dev"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--3bbd1db9-20b3-5f49-afba-c3096ba5c74f",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--1fd86470-9927-56a0-8326-28506b219033"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „smartid“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--8211eb63-4b58-5d6e-86ca-749ab877c4f7",
      "value": "verify-smartident-live[.]pages[.]dev"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--5741db0f-2ec9-5eb7-96c4-416c102b82dc",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--8211eb63-4b58-5d6e-86ca-749ab877c4f7"
      ],
      "x_cloudscout_category": "bankas",
      "x_cloudscout_brand": "Bankas",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „smartid“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--ef0fce6e-c605-5099-9e9c-164e61ec8d4c",
      "value": "lp-expresspavingllc-com-19072026[.]pages[.]dev"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--91f970ee-32b8-57fb-996c-42ceafac13ba",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--ef0fce6e-c605-5099-9e9c-164e61ec8d4c"
      ],
      "x_cloudscout_category": "siuntos",
      "x_cloudscout_brand": "Paštas / kurjeris",
      "x_cloudscout_status": "Aktyvus",
      "x_cloudscout_match_score": 2,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Domene minimas „lp-express“, nors tai ne oficialus tos įstaigos adresas.",
        "Daug brūkšnelių — būdinga automatiškai generuotiems sukčių domenams."
      ]
    },
    {
      "type": "domain-name",
      "spec_version": "2.1",
      "id": "domain-name--6784741a-8a0c-55e9-9e99-19fce7bc1521",
      "value": "lietuvospost[.]help"
    },
    {
      "type": "observed-data",
      "spec_version": "2.1",
      "id": "observed-data--617e8f97-ee9b-582b-a354-050cb78ae71a",
      "created": "2026-09-01T11:45:28+00:00",
      "modified": "2026-09-01T11:45:28+00:00",
      "first_observed": "2026-08-29T00:00:00Z",
      "last_observed": "2026-08-29T00:00:00Z",
      "number_observed": 1,
      "object_refs": [
        "domain-name--6784741a-8a0c-55e9-9e99-19fce7bc1521"
      ],
      "x_cloudscout_category": "kita",
      "x_cloudscout_brand": "Kita",
      "x_cloudscout_status": "Pašalintas",
      "x_cloudscout_match_score": 0,
      "x_cloudscout_confidence": "Aukštas",
      "x_cloudscout_evidence_tier": "grupuote",
      "x_cloudscout_cluster": "LT bankų cloak",
      "x_cloudscout_reason_codes": [
        "Bendras techninis pėdsakas su kitais aferų domenais — bendras kit failas (SHA-256) su 43 kt. domenu; tas pats kit kaip žinomo „lt_cloak“ domeno.",
        "Pašto/kurjerio vardas + disposable galūnė.",
        "Reta, pigi galūnė .help — tokias mėgsta sukčiai."
      ]
    }
  ]
}