coinpilot-bot.io campaign · 3 servers · 7 findings
One confirmed site (coinpilot-bot.io) led to 3 servers hosting 14 CoinPilot look-alikes and 2 site(s) of other brands (ShopNova, VaultPay) — the same operator.
Infrastructure graph · drag nodes · solid = included, dashed = excluded by triage ⚙ budgeted pivot · ≤2 hops · ≤100 nodes
Dashed nodes were excluded by triage (reverse-IP noise, or the brand's own / whitelisted sites shown only for context). Edges: passive_dns · cert · favicon · tracking_id · reverse_whois
Actor profile · what ties the operation together
| Registrant | ops@affnet-mail.example |
|---|---|
| Servers | 198.51.100.79 |
| Certificates | bbbbbbbbbbbbbbbb… |
| Tracking ids | none observed |
| Investigated | 2026-10-14 09:46:35 |
Export · indicators your firewall or SIEM can block
Domains, IPs, certificate hashes and tracking IDs, each with first_seen and the evidence row it came from. STIX 2.1 imports directly into MISP, OpenCTI or Splunk ES. Mapped indicators also feed the Infrastructure signals of later scans.
Findings in this map
Co-hosted triage · every node and why it is in or out
Triage keeps a neighbour only if it shares a link signal (certificate, favicon, tracking ID, registrant) or looks like the brand; everything else on a shared server is reverse-IP noise. The brand's own and whitelisted sites are shown for context only.
| Node | Type | Decision | Reason | Attributes |
|---|---|---|---|---|
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | certificate | included | seed certificate | |
| coin-pilot.io critical | domain | included | already a critical finding for this brand | |
| coinpilot-bot.io critical | domain | included | seed finding | |
| coinpilott.io critical | domain | included | already a critical finding for this brand | |
| coinpllot.io critical | domain | included | already a critical finding for this brand | |
| coinplot.io critical | domain | included | already a critical finding for this brand | |
| cooinpilot.io critical | domain | included | already a critical finding for this brand | |
| gallery-of-cats.example | domain | excluded | co-hosted neighbour without link signals (reverse-IP noise); AI triage skipped (unreachable) | |
| koinpilot.io critical | domain | included | already a critical finding for this brand | |
| shopnova-eu.com | domain | included | shares cert with the campaign | |
| shopnowa.com | domain | included | shares cert with the campaign | AI: phishing impersonating ShopNova (85%); credential form; lure language; page presents itself as ShopNova other brand: ShopNova |
| shoqnova.com | domain | included | shares cert with the campaign | AI: phishing impersonating ShopNova (65%); credential form; page presents itself as ShopNova |
| vault-pay.co | domain | included | shares cert with the campaign | AI: phishing impersonating VaultPay (97%); credential form; lure language; form posts off-site; page presents itself as VaultPay other brand: VaultPay |
| vaultpay-login.com | domain | included | shares cert with the campaign | AI: phishing impersonating VaultPay (97%); credential form; lure language; form posts off-site; page presents itself as VaultPay other brand: VaultPay |
| vaultpay-secure.net | domain | included | shares cert with the campaign | AI: phishing impersonating VaultPay (97%); credential form; lure language; form posts off-site; page presents itself as VaultPay other brand: VaultPay |
| vaultpay-verify.com | domain | included | shares cert with the campaign | AI: phishing impersonating VaultPay (97%); credential form; lure language; form posts off-site; page presents itself as VaultPay other brand: VaultPay |
| 198.51.100.77 | ip | included | resolved by the seed | org: Mock Hosting LLC asn: 64531 ports: 80, 443 |
| 198.51.100.78 | ip | included | resolved by the seed | org: Mock Hosting LLC asn: 64536 ports: 80, 443 |
| 198.51.100.79 | ip | included | resolved by the seed | org: Mock Hosting LLC asn: 64539 ports: 80, 443 |
| ops@affnet-mail.example | registrant | included | seed registrant |