vaultpay-verify.com campaign · 1 server · 4 findings
One confirmed site (vaultpay-verify.com) led to 1 server hosting 14 VaultPay look-alikes and 1 site(s) of other brands (ShopNova) — the same operator.
Infrastructure graph · drag nodes · solid = included, dashed = excluded by triage ⚙ budgeted pivot · ≤2 hops · ≤100 nodes
Dashed nodes were excluded by triage (reverse-IP noise, or the brand's own / whitelisted sites shown only for context). Edges: passive_dns · cert · favicon · tracking_id · reverse_whois
Actor profile · what ties the operation together
| Registrant | ops@affnet-mail.example |
|---|---|
| Servers | 198.51.100.77 |
| Certificates | bbbbbbbbbbbbbbbb… |
| Tracking ids | UA-777001-1 |
| Investigated | 2026-10-14 09:46:50 |
Other brands hit by the same operator: ShopNova (found by AI triage — shared with those brands' teams, never acted on).
Export · indicators your firewall or SIEM can block
Domains, IPs, certificate hashes and tracking IDs, each with first_seen and the evidence row it came from. STIX 2.1 imports directly into MISP, OpenCTI or Splunk ES. Mapped indicators also feed the Infrastructure signals of later scans.
Findings in this map
Co-hosted triage · every node and why it is in or out
Triage keeps a neighbour only if it shares a link signal (certificate, favicon, tracking ID, registrant) or looks like the brand; everything else on a shared server is reverse-IP noise. The brand's own and whitelisted sites are shown for context only.
| Node | Type | Decision | Reason | Attributes |
|---|---|---|---|---|
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | certificate | included | seed certificate | |
| coin-pilot.io | domain | included | shares cert with the campaign | AI: phishing impersonating CoinPilot (65%); credential form; page presents itself as CoinPilot |
| coinpilot-bot.io | domain | included | shares cert with the campaign | |
| coinpilott.io | domain | included | shares cert with the campaign | AI: phishing impersonating CoinPilot (65%); credential form; page presents itself as CoinPilot |
| coinpllot.io | domain | included | shares cert with the campaign | AI: phishing impersonating CoinPilot (65%); credential form; page presents itself as CoinPilot |
| coinplot.io | domain | included | shares cert with the campaign | |
| cooinpilot.io | domain | included | shares cert with the campaign | |
| gallery-of-cats.example | domain | excluded | co-hosted neighbour without link signals (reverse-IP noise); AI triage skipped (unreachable) | |
| koinpilot.io | domain | included | shares cert with the campaign | |
| shopnova-eu.com | domain | included | shares cert with the campaign | |
| shopnowa.com | domain | included | shares cert with the campaign | AI: phishing impersonating ShopNova (85%); credential form; lure language; page presents itself as ShopNova other brand: ShopNova |
| shoqnova.com | domain | included | shares cert with the campaign | AI: phishing impersonating ShopNova (65%); credential form; page presents itself as ShopNova |
| vault-pay.co critical | domain | included | already a critical finding for this brand | |
| vaultpay-login.com critical | domain | included | already a critical finding for this brand | |
| vaultpay-secure.net critical | domain | included | already a critical finding for this brand | |
| vaultpay-verify.com critical | domain | included | seed finding | |
| 198.51.100.77 | ip | included | resolved by the seed | org: Mock Hosting LLC asn: 64531 ports: 80, 443 |
| ops@affnet-mail.example | registrant | included | seed registrant | |
| UA-777001-1 | tracking_id | included | tracking id in seed page |