ATTACK INFRASTRUCTURE · one confirmed finding → the attacker's whole network of servers, certificates and sites
One confirmed phishing site → the servers, certificates and sister domains it shares. That is the attacker's infrastructure: take down all of it, not one site.
Two views of the same thing: an infrastructure map starts from one confirmed site and follows what it shares (below);
an operation groups every confirmed site that belongs to the same attacker — all sites on one map →. Each map adds to the operations; an operation card drafts the takedowns of all its sites.
Actor intel · other brands hit by the same infrastructure
ShopNova
— found by AI triage of co-hosted pages; shared with those brands' teams, never acted on.
Everyone at a glance · 4 of 4 confirmed sites investigated · what they share
Built from the investigations that follow every confirmation, so nothing has to be opened one by one. A server that carries several confirmed sites, the same registrar or the same name servers are the operator's fingerprints. Shared Cloudflare addresses carry thousands of unrelated sites and are not evidence of a link.
SERVERS
| Server | Where | Network | Engines | Abuse | Confirmed sites on it |
|---|
| 198.51.100.77 |
Russia |
AS64531 Fast VPS LLC |
3 | 79 |
4 · vaultpay-verify.com, vaultpay-login.com, vaultpay-secure.net, vault-pay.co |
REGISTRARS
| Mock Registrar LLC | 4 · vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
NAME SERVERS
| ns1.mock-dns.example | 4 · vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
| ns2.mock-dns.example | 4 · vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Infrastructure maps · 1