Analysing again…leaving that link out and working out which sites are still connected
ALL CONFIRMED SITES · one map: are they connected, and by what?
✓
Analysis complete
· 4 sites · 1 operation · 0 unattributed
Every site was mapped and investigated. The ties below use all of it.
4 of 4 confirmed sites are tied together in 1 group. The largest has 4 sites that share the same TLS certificate, the same analytics / pixel ID, the same place the stolen data is sent, the same registrant, the same server: vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com.
0
confirmed sites
0
connected groups
0
sites in a group
0
no strong link
0
strong links
0
hints & common
The map
Show:
Big dot with a name = a site you confirmed (colour = severity) · small dot with a letter = something several sites have in common · line = “has that”, thicker = a stronger tie. Each operation sits in its own coloured area. Point at a dot to light up what it touches, click it for details. Scroll to zoom, drag the background to move the map, drag a dot to move it (double-click it to let go).
affiliate id · registrant · DNS token
server
TLS certificate · page code
analytics ID · where the data goes
redirect host
traffic campaign
dashed = a hint, not proof on its own
Which sites are connected · one card per operation (a group of sites that belong to one attacker)
⚿
Phishing kit · sends data to collect.affnet-mail.example
Operation 1 · Phishing kit — collects passwords or card details
100
4sites
1brand
2026-08-31
→ 2026-09-04bought · in waves
→ 2026-09-04bought · in waves
4/4credential form
Because they share
registrantops@affnet-mail.example
90%
analytics idUA-777001-1
90%
data goes tocollect.affnet-mail.example
90%
certificatebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb...
80%
Each of the 4 domains collects passwords or card details. 4 of 4 domains were registered within 5 day(s) (2026-08-31 → 2026-09-04): a batch, not a coincidence. 4/4 credential form.
| Registrar | Mock Registrar LLC ×4 |
|---|---|
| Hosting | Fast VPS LLC (hoster) ×4 |
First step: Report collect.affnet-mail.example, where the stolen data goes
Details
How to stop it 3
1. Report collect.affnet-mail.example, where the stolen data goes
A single takedown of the collecting host stops every kit that posts to it.
vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
2. One bulk abuse report to Mock Registrar LLC
4 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
3. Report the hosting provider Fast VPS LLC
The provider can disable the servers that host these pages.
vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
Who is with whom 1 cluster
Sites that share exactly the same things are shown together, so many links with the same sites read as one line.
vault-pay.covaultpay-login.comvaultpay-secure.netvaultpay-verify.com
4 sites share:
registrant ops@affnet-mail.example 90%analytics id UA-777001-1 90%data goes to collect.affnet-mail.example 90%certificate bbbbbbbbbbbbbbbbbbb... 80%server 198.51.100.77 80%page code page 67392ce2a1 60%registered together Mock Registrar LLC... 30%page look screenshot 8c3b6f563c 30%
Who against whom · how sure we are that two sites are one operation (hover a cell for what ties them)
vault-pay.co | vaultpay-login.com | vaultpay-secure.net | vaultpay-verify.com | |
|---|---|---|---|---|
| vault-pay.co | 100 | 100 | 100 | |
| vaultpay-login.com | 100 | 100 | 100 | |
| vaultpay-secure.net | 100 | 100 | 100 | |
| vaultpay-verify.com | 100 | 100 | 100 |
Who shares what 4 of the 4 sites are on one server
Same server (address) 1
| 198.51.100.77 Fast VPS LLC · hoster |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
TLS certificates 1
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb... | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Analytics / pixel IDs 1
| UA-777001-1 | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Registrants 1
| ops@affnet-mail.example | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Where the stolen data goes 1
| collect.affnet-mail.example | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Name servers 2
| ns1.mock-dns.example | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
| ns2.mock-dns.example | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Registrars 1
| Mock Registrar LLC | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Bought together 1
| Mock Registrar LLC · 2026-08-31 → 2026-09-04 | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Same page code 1
| page 67392ce2a1 | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Pages that look the same 1
| screenshot 8c3b6f563c | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Favicons 1
| 1401845590 | 4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Site by site 4
| site | registered | registrar | server(s) | hosting | name servers | ends on |
|---|---|---|---|---|---|---|
| vault-pay.co | 2026-09-02 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vault-pay.co |
| vaultpay-login.com | 2026-09-04 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-login.com |
| vaultpay-secure.net | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-secure.net |
| vaultpay-verify.com | 2026-08-31 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-verify.com |
What ties them together 8
the same registrant90%
ops@affnet-mail.example · 4 sites
ops@affnet-mail.example · 4 sites
the same analytics / pixel ID90%
UA-777001-1 · 4 sites
UA-777001-1 · 4 sites
the same place the stolen data is sent90%
collect.affnet-mail.example · 4 sites
collect.affnet-mail.example · 4 sites
the same TLS certificate80%
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb · 4 sites
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb · 4 sites
the same server80%
198.51.100.77 · 4 sites · Fast VPS LLC
198.51.100.77 · 4 sites · Fast VPS LLC
the same page code60% · hint
page 67392ce2a1 · 4 sites
page 67392ce2a1 · 4 sites
registered together at one registrar30% · hint
Mock Registrar LLC · 2026-08-31 → 2026-09-04 · 4 sites
Mock Registrar LLC · 2026-08-31 → 2026-09-04 · 4 sites
a page that looks the same30% · hint
screenshot 8c3b6f563c · 4 sites
screenshot 8c3b6f563c · 4 sites
Also in common, but weak (they never group sites):
the same favicon
1401845590
1401845590
the same registrar
Mock Registrar LLC
Mock Registrar LLC
the same name server
ns1.mock-dns.example
ns1.mock-dns.example
the same name server
ns2.mock-dns.example
ns2.mock-dns.example
Evidence per site 4
| site | registrant | tracking id | data sink | certificate | ip | kit | batch | kit look |
|---|---|---|---|---|---|---|---|---|
| vault-pay.co | ● | ● | ● | ● | ● | ● | ● | ● |
| vaultpay-login.com | ● | ● | ● | ● | ● | ● | ● | ● |
| vaultpay-secure.net | ● | ● | ● | ● | ● | ● | ● | ● |
| vaultpay-verify.com | ● | ● | ● | ● | ● | ● | ● | ● |
The pattern · what these attacks have in common
4 sites (4 critical). 4 of 4 domains were registered within 5 day(s) (2026-08-31 → 2026-09-04): a batch, not a coincidence; names: 3 × the brand plus extra words, 1 × a typo of the brand; endings: .com (2), .net (1), .co (1); hosted in Russia (4).
- 4 of 4 domains were registered within 5 day(s) (2026-08-31 → 2026-09-04): a batch, not a coincidence
- names: 3 × the brand plus extra words, 1 × a typo of the brand
- endings: .com (2), .net (1), .co (1)
- hosted in Russia (4)
- the kit copies the brand's favicon (4/4); copies the brand's homepage (4/4); looks 85%+ like the brand (4/4); asks for a password (4/4); sends what is typed to another server (4/4)
Registered, oldest first:
2026-08-31 vaultpay-verify.com2026-09-02 vault-pay.co2026-09-03 vaultpay-secure.net2026-09-04 vaultpay-login.com
What counts as a connection · switch a whole kind off if it proves nothing to you
For example the Cloudflare account or the registrar: many unrelated sites share them. Switching a kind off takes it out of the analysis and the map is analysed again. To leave out only one thing, use the red “not evidence” button next to it in the cards above.