Is booking.radailiudvaras.lt safe?

No. MalwareAnalyzer scanned booking.radailiudvaras.lt on 22 Aug 2026 and returned a malicious verdict with a score of 62 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.

How was booking.radailiudvaras.lt checked?

A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

booking.radailiudvaras.lt - malicious URL scan, 22 Aug 2026

MalwareAnalyzer by Cyble scanned booking.radailiudvaras.lt and returned a malicious verdict (score 62), categorised as credential-harvest. The page resolved to 89.40.9.6 on UAB Interneto vizija in LT. 13 domains and 11 IPs were contacted, over 32 HTTP requests. This is a point-in-time observation from 22 Aug 2026; the page may have changed since.

Scan result

Verdict: malicious (score 62) · Confidence 74%
Scanned URL: https://booking.radailiudvaras.lt/
Domain: booking.radailiudvaras.lt · IP: 89.40.9.6 · AS212531 · LT
Server: nginx/1.26.1
Page title: Radailių Dvaro - rezervavimo internetu ir dovanų kuponų sistema
HTTP status: 200 · text/html; charset=UTF-8
TLS issuer: C=US, O=Let's Encrypt, CN=YR2 · valid to Nov 20 05: · subject CN=booking.radailiudvaras.lt
HTTP requests captured: 32 · cookies set: 6 · outgoing links: 110
Scan tier: standard · observed 2026-08-22 13:35:12 UTC

Antivirus & YARA (0 of 48 engines)

No engine flagged this page's content.

Why this verdict

Runtime data beacon to mpc2-prod-26-is5qnl632q-uc.a.run.app
Credential-harvesting form
Certificate issued < 48h ago
Matches phishing-kit family "Meta / Facebook Login Kit"

Detected technologies

Nginx
Google Analytics

Contacted infrastructure

89.40.9.6 - AS212531 UAB Interneto vizija (Lithuania)
157.240.8.23 - AS32934 Facebook, Inc. (Australia)
142.251.152.119 - AS15169 Google LLC (Netherlands)
142.250.195.136 - AS15169 Google LLC (India)
142.251.222.3 - AS15169 Google LLC (Japan)
157.240.8.35 - AS32934 Facebook, Inc. (Australia)
142.251.222.230 - AS15169 Google LLC (Malaysia)
172.217.25.206 - AS15169 Google LLC (Malaysia)

Observed indicators

booking.radailiudvaras.lt
www.googletagmanager.com
www.facebook.com
www.radailiudvaras.lt
bookingrobot.eu
www.google.com
maxcdn.bootstrapcdn.com
connect.facebook.net
www.gstatic.com
ad.doubleclick.net
mpc2-prod-26-is5qnl632q-uc.a.run.app
radailiudvaras-booking.bookingrobot.online
www.google-analytics.com
89.40.9.6
104.18.11.207
157.240.8.23
142.251.152.119
142.250.195.136
142.251.222.3
157.240.8.35

Questions about booking.radailiudvaras.lt

Is booking.radailiudvaras.lt safe?: No. MalwareAnalyzer scanned booking.radailiudvaras.lt on 22 Aug 2026 and returned a malicious verdict with a score of 62 out of 100, categorised as credential-harvest. Treat it as hostile until it is re-checked.
How was booking.radailiudvaras.lt checked?: A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the standard tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.

Scanned at the standard tier - see how URL scanning works.

Scan another URL · Latest analyzed threats · All scans of booking.radailiudvaras.lt

Scanned on MalwareAnalyzer by Cyble · Open interactive scan