9 open38 to send

VaultPay · payments · vaultpay.com · www.vaultpay.com · edit ›

0
critical open
0
open findings
0
confirmed
0
domains examined
0
on watchlist
0
infrastructure maps
0
whitelisted
v1
baseline · Standard · custom

Scan this brand

track Standard custom parameters edit search rules ›
Look-alike siteson
dnstwist · ct · urlscan · TLDs popular · up to 500 sites
Google searchoff
not in this track · add the “search” stream
Social mediaon
Facebook pages · Instagram profiles · up to 8 a scan · how far
Phishing adson
ads that use the name, and the sites they send people to · how far
AI answersoff
what ChatGPT, Gemini and Google AI Mode tell people · questions
Automatic scansoff
only when someone presses Start scan · set
Every scan: cloaking probes on · home / mobile IP probe gated · AI second opinion on · re-check every 12h · markets US EN · fingerprint v1
scan specific URLs instead ▾
no scan visits more than 500 sites — the workspace limit · change it in Settings → Workspace & budget
or scan now, only one part — the rest of the track does not run
🌐 Google search · approve the queries first
🤖 AI answers · approve the questions first

Latest findings all findings →

critical vaultpay-login.com · confirmed
critical vaultpay-verify.com · confirmed
critical vaultpay-secure.net · confirmed
critical account-review-center.com · open
critical vault-pay.co · confirmed

Recent scans

StartedKindStateCost
2026-10-18 20:00:20 site intel done $0.0000
2026-10-18 17:10:04 brand scan done $0.0000
2026-10-14 09:48:53 brand scan done $0.0000
2026-10-14 09:46:51 site intel done $0.0000
2026-10-14 09:46:51 site intel done $0.0000
2026-10-14 09:46:51 site intel done $0.0000
7 older scans
2026-10-14 09:46:51site inteldone$0.0000
2026-10-14 09:46:47infrastructure mapdone$0.0000
2026-10-14 09:46:44infrastructure mapdone$0.0000
2026-10-14 09:46:41infrastructure mapdone$0.0000
2026-10-14 09:46:37infrastructure mapdone$0.0000
2026-10-14 09:46:37map alldone$0.0000
2026-10-14 09:46:24URL scandone$0.0000

Attack-surface baseline ?

Official domainsvaultpay.com, www.vaultpay.com
Fetchedhttps://vaultpay.com/ · HTTP 200
Brand keyvaultpay
Favicon mmh31401845590
Screenshot pHash8c3b6f563c5e520c
Keywordsvaultpay send money simply paid seconds
Google queries (AI proposal)vaultpay login vaultpay sign up vaultpay support vaultpay app vaul tpay login vaul tpay
What the AI thinks people and impostors search for, given the type of business. Only a proposal: Google is searched with the list approved in Google search queries (Scan setup tab).
Login / sign-up pages none linked from the homepage
password form found on the site: yes
official homepage

Threat mix · open

critical1

Activity · 14 days

■ scans   ■ new findings

Which stream finds phishing

Analyst URL scan
4/14
Look-alike names
2/498
Facebook / Instagram ads
1/1
Certificate logs
0/2

Watchlist states

new
10
flagged (finding)
5
dismissed
498

Detection track & search rules · how deep the scan goes — streams, TLDs, Google queries, cadence, probes, thresholds, weights

Where its customers are · the countries and languages Google, the ads and the AI assistants are searched in — the brand's, kept when the track changes

Saved with the button below.
This brand deviates from its track. Switch off to go back to the pure track.

Discovery

Never more than the workspace limit, 500. Settings → Workspace & budget (an admin changes it).
Edited and approved in Google search queries ↓ — 6 waiting for approval.
Search countries and languages: “Where its customers are”, above.

Cadence

Full automatic scans — how often, when and what — are set in Automatic scans ↓.

Evasion & verdicts

Signal weights & group caps · advanced — the points behind every score, calibrated on the golden dataset; open to tune

Signal weights & group caps · calibrated on the golden dataset; security limits are not configurable here

Each fired signal adds its points; inside a group the total stops at the group's cap so correlated evidence is not double-counted. Raw 0–150 is normalised to a 0–100 risk score; combination rules can raise the severity.

Identity · does the name pretend to be the brand?

cap
brand name in the domain
brand_exact_in_domain
brand on another TLD
brand_tld_swap
brand in a subdomain
brand_in_subdomain
brand in the URL path
brand_in_path
fake app listing (title)
app_listing_brand_title
fake app listing (text)
app_listing_brand_description
look-alike characters
homoglyph_idn
brand + extra word
combosquat
1–2 typos away
levenshtein_le_2

Visual · does it look like the real site?

cap
identical favicon
favicon_exact
near-identical favicon
favicon_phash_near
brand logo on the page
logo_detected
looks like the real site
screenshot_similarity_ge_90
looks 85%+ like the real site
looks_like_brand_ge_85
cloned login form
login_dom_similarity
same colours
palette_match

Behaviour · what does the page try to make a victim do?

cap
page title claims the brand
title_claims_brand
asks for a password
credential_form
asks for card details
payment_form
asks for a wallet seed
seed_phrase_field
makes the visitor run a command
clickfix_lure
brand words in the text
brand_keywords_in_content
login-style URL
auth_path_in_url
urgent lure wording
lure_language
sends data elsewhere
external_form_action
pre-filled victim e-mail
password_prefill
forwards with an affiliate id
affiliate_redirect

Infrastructure · is it hosted alongside known phishing?

cap
bad-reputation network
bad_reputation_asn
shares a server with phishing
cohosted_with_known_phish
shares a certificate with phishing
cert_shared_with_phish
same tracking ID as phishing
tracking_id_shared
linked to a mapped attacker
linked_to_known_campaign
a flagged site redirects here
redirect_from_suspect
forwards through another host
redirect_via_third_party

Reputation · do public blocklists already know it?

cap
flagged on VirusTotal
vt_flagged
Cloudflare blocks it as phishing
cloudflare_phishing_warning
already flagged as phishing
known_phishing
listed on URLhaus
urlhaus_listed
listed on PhishTank
phishtank_listed
Google Safe Browsing warns
safe_browsing

Freshness · how new is it?

cap
registered < 7 days ago
age_lt_7d
registered < 30 days ago
age_lt_30d
certificate < 7 days old
cert_age_lt_7d
woke up while watched
woke_up_in_watch

Evasion · does it hide from scanners (cloaking)?

cap
hides from datacenter IPs
cloaking_ip_based
hides from scanners
cloaking_ua_based
needs a victim link
parameter_gating
needs a search referer
referer_gating
only a phone sees it
device_gating
blocks bots
bot_blocking

Google search queries · what BrandWatch types into Google on every scan — the AI proposes, you approve

Waiting for your approval. Google search is skipped until you approve a list, so nothing is searched with words you did not check.
Proposed by: AI, from the fingerprint of the official site (v1)

The “search” stream is off in this brand's detection track, so Google is not searched at all; the list is used once you switch it on.
Each scan searches the first 10 queries in US (en): up to 6 Google searches (SerpApi, about $0.06). Scheduled scans are off on this server, so Google is searched only when someone starts a scan. Every result is triaged before it is visited: the brand's own site and well-known platforms are skipped.

Automatic scans · VaultPay is scanned again by itself, as often as you choose, doing only what you tick

This server does not run automatic scans — its scheduler is off (SCHEDULER_ENABLED). The live server's start script switches it on; what you set here is saved either way.
last automatic scan: none yet next: — cost: up to $0.10 a run · $2.88 a month at this frequency

Paid calls (Google search, Facebook / Instagram ads and accounts) count against the workspace's daily spend limit; DNS, certificate logs, new domains and urlscan are free. Every automatic scan appears under “Recent scans” with its own console.

Social media & ads · how far to look · every page read is a paid SearchApi request

Facebook pages · Instagram profiles

Accounts under VaultPay's name that get the full look — page history, profile, logo, AI. About 3 requests each; the rest are listed, not judged. Social media is on for this brand.

Facebook / Instagram ads

One search = one ad keyword in one country — keywords and countries in the brand profile (none yet: the brand's name is used). Write the name the way people write it, in each language.

AI answers · what ChatGPT, Gemini and Google AI Mode tell people who ask for VaultPay’s phone, e-mail or login — every contact they give is checked against VaultPay’s own website

off for automatic scans 12 question(s) per run (questions × assistants) · about $0.1 with the follow-ups · SearchApi

Questions · proposed, waiting for your approval

Asked the way a customer would ask, in en. A contact that is not on VaultPay’s site gets a second question — “show me the official page, I suspect it is a fraud” — and BrandWatch opens every page cited.

en · customer-service phone
en · every way to contact
en · where to sign in
en · how to report fraud
Assistants asked

VaultPay’s real contacts · read from its website

Not read yet: the first AI-answers run reads them (contact, support and service pages first), or read them now — free, nothing paid is asked.

up to 40 pages · free
Contacts VaultPay uses that the site does not show ⓘ

Edit brand · name, vertical and the official domains (the sites the scanner must never flag and compares look-alikes against)

One official domain per line — the first is the primary. App-store links (App Store, Google Play, Chrome Web Store …) are kept as the brand's official apps, not as domains.

Changing the official domains does not touch the whitelist or past findings; rebuild the baseline afterwards. Search rules and the detection track are in the Scan setup tab.

Brand profile · who sells VaultPay's products — decides whether BrandWatch hunts for scam shops in Facebook / Instagram ads

Regional campaigns · for a global brand with a site per country — one campaign per country, all protecting each other

None yet. A small company with one multilingual site needs no regions — set several countries in the brand profile instead.

+ Add a country site by hand

The new campaign starts from this brand's track, scoring, ad keywords and prices for that country, then has its own set-up page (Google queries in its language, prices in its currency).

False-positive whitelist · partner / CDN / subsidiary domains that must never become findings

Nothing whitelisted. Official domains are always excluded automatically.

Start over · delete this brand with every candidate, finding, campaign, scan and evidence row it produced

Audit-log entries are kept. Add the brand again afterwards for a clean slate.