vmi.lt-vpm-e-prisijungti.info
Open in
urlscan Pro
104.21.41.163
Malicious Activity!
Public Scan
Effective URL: https://vmi.lt-vpm-e-prisijungti.info/pages/?p=login
Submission: On November 23 via manual from LT — Scanned from SE
Summary
TLS certificate: Issued by E1 on November 23rd 2023. Valid for: 3 months.
This is the only time vmi.lt-vpm-e-prisijungti.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: LT Government (Government)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 9 | 104.21.41.163 104.21.41.163 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
lt-vpm-e-prisijungti.info
2 redirects
vmi.lt-vpm-e-prisijungti.info |
193 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
9 | vmi.lt-vpm-e-prisijungti.info |
2 redirects
vmi.lt-vpm-e-prisijungti.info
|
7 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
lt-vpm-e-prisijungti.info E1 |
2023-11-23 - 2024-02-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://vmi.lt-vpm-e-prisijungti.info/pages/?p=login
Frame ID: F0D7CB6C085C05315E31F63155A1BCC1
Requests: 7 HTTP requests in this frame
Screenshot
Page Title
Prisijungti prie VMI sistemųPage URL History Show full URLs
-
https://vmi.lt-vpm-e-prisijungti.info/
HTTP 302
https://vmi.lt-vpm-e-prisijungti.info/pages HTTP 302
https://vmi.lt-vpm-e-prisijungti.info/pages/?p=login Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://vmi.lt-vpm-e-prisijungti.info/
HTTP 302
https://vmi.lt-vpm-e-prisijungti.info/pages HTTP 302
https://vmi.lt-vpm-e-prisijungti.info/pages/?p=login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
vmi.lt-vpm-e-prisijungti.info/pages/ Redirect Chain
|
7 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
eskis.css
vmi.lt-vpm-e-prisijungti.info/front_end/front_end_files/landing_page/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cas.js
vmi.lt-vpm-e-prisijungti.info/front_end/front_end_files/landing_page/ |
1 KB 955 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fonts.css
vmi.lt-vpm-e-prisijungti.info/front_end/front_end_files/landing_page/ |
4 KB 910 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vmi-logo.svg
vmi.lt-vpm-e-prisijungti.info/front_end/front_end_files/landing_page/ |
29 KB 8 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SourceSansPro-Regular.ttf.woff2
vmi.lt-vpm-e-prisijungti.info/front_end/front_end_files/landing_page/ |
88 KB 88 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
SourceSansPro-Bold.ttf.woff2
vmi.lt-vpm-e-prisijungti.info/front_end/front_end_files/landing_page/ |
87 KB 88 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: LT Government (Government)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture string| editInnerHTML string| deleteInnerHTML object| currentRow function| swapButtonsForConfirm function| resetOldValue1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
vmi.lt-vpm-e-prisijungti.info/ | Name: PHPSESSID Value: 3cakcrdv4vcvu84o551uo8log4 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
vmi.lt-vpm-e-prisijungti.info
104.21.41.163
01ea2e84c96e6ac16817f2a48598ec477399b8ff1741cc902919b6445ec1f9fa
7bce8abd9a4f84bae9b69b890e132b207bd8d1462530b683aa7158bb868bdc01
8480a07d2d07f9dc012058e84be88468cc09354c8eee86375524700b7c059063
bed0c242e129c6c1c610f998ce2735a6a4b2f5631a38fadf51774f35bdaf686e
cfce3bb3cde12fe2e9683493807d49769360dd738f9889193e7c36c90dd54714
d3f2a7c124a4a987cbf255a3579b9866789cc3e561d3ab7cb2d09bee40b137e0
feab5b69e68f4e49b0f162a1bd374addb17d0ce0cad3ebd18111af3320d206f6