4
confirmed sites
100%
confidence · certain
Phishing kit
what it does
2026-08-31 → 2026-09-04
domains registered · in waves
3
ways to stop it
Because the same registrant ops@affnet-mail.example 90%the same analytics / pixel ID UA-777001-1 90%the same place the stolen data is sent collect.affnet-mail.example 90%the same TLS certificate bbbbbbbbbbbbbbbbbbbbbbbbbbb... 80%
Each of the 4 domains collects passwords or card details. 4 of 4 domains were registered within 5 day(s) (2026-08-31 → 2026-09-04): a batch, not a coincidence. 4/4 credential form.
- 4/4 credential form
- 4/4 external form action
How to stop it · the shortest way, first
1
Report collect.affnet-mail.example, where the stolen data goes
A single takedown of the collecting host stops every kit that posts to it.
vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
2
One bulk abuse report to Mock Registrar LLC
4 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
3
Report the hosting provider Fast VPS LLC
The provider can disable the servers that host these pages.
vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
The sites · 4
| Site | Severity | Registered | Registrar | Server(s) | Hosting | Name servers | Ends on |
|---|---|---|---|---|---|---|---|
| vault-pay.co | critical | 2026-09-02 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vault-pay.co |
| vaultpay-login.com | critical | 2026-09-04 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-login.com |
| vaultpay-secure.net | critical | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-secure.net |
| vaultpay-verify.com | critical | 2026-08-31 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-verify.com |
Who is with whom · 1 cluster
4 of the 4 sites are on one server. Sites that share exactly the same things are shown together, so a long list of links reads as one line.
vault-pay.covaultpay-login.comvaultpay-secure.netvaultpay-verify.com
4 sites share
registrant ops@affnet-mail.example 90%analytics id UA-777001-1 90%data goes to collect.affnet-mail.example 90%certificate bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb 80%server 198.51.100.77 80%page code page 67392ce2a1 60%registered together Mock Registrar LLC · 2026-08-31 → 2026-09-04 30%page look screenshot 8c3b6f563c 30%
Who against whom
How sure we are that two sites are one operation (the darker the cell, the surer). The number is shown from 75%, where two sites count as one operation.
vault-pay.co | vaultpay-login.com | vaultpay-secure.net | vaultpay-verify.com | |
|---|---|---|---|---|
| vault-pay.co | 100 | 100 | 100 | |
| vaultpay-login.com | 100 | 100 | 100 | |
| vaultpay-secure.net | 100 | 100 | 100 | |
| vaultpay-verify.com | 100 | 100 | 100 |
Who shares what · every shared server, certificate, registrant and more
Same server (address) · 1
| Value | Strength | Shared by |
|---|---|---|
| 198.51.100.77 Fast VPS LLC · hoster |
80% proof |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
TLS certificates · 1
| Value | Strength | Shared by |
|---|---|---|
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 80% proof |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Analytics / pixel IDs · 1
| Value | Strength | Shared by |
|---|---|---|
| UA-777001-1 | 90% proof |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Registrants · 1
| Value | Strength | Shared by |
|---|---|---|
| ops@affnet-mail.example | 90% proof |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Where the stolen data goes · 1
| Value | Strength | Shared by |
|---|---|---|
| collect.affnet-mail.example | 90% proof |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Name servers · 2
| Value | Strength | Shared by |
|---|---|---|
| ns1.mock-dns.example | 10% common |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
| ns2.mock-dns.example | 10% common |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Registrars · 1
| Value | Strength | Shared by |
|---|---|---|
| Mock Registrar LLC | 10% common |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Bought together · 1
| Value | Strength | Shared by |
|---|---|---|
| Mock Registrar LLC · 2026-08-31 → 2026-09-04 | 30% a hint |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Same page code · 1
| Value | Strength | Shared by |
|---|---|---|
| page 67392ce2a1 | 60% a hint |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Pages that look the same · 1
| Value | Strength | Shared by |
|---|---|---|
| screenshot 8c3b6f563c | 30% a hint |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Favicons · 1
| Value | Strength | Shared by |
|---|---|---|
| 1401845590 | 10% common |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Toolkit · what the attacker uses
| Kind | What |
|---|---|
| Registrars | Mock Registrar LLC ×4 |
| Hosting | Fast VPS LLC (hoster) ×4 |
| Redirect hosts | – |
| Name servers | ns1.mock-dns.example ×4ns2.mock-dns.example ×4 |
| Certificate issuers | C=US O=Mock Trust Services CN=MT1 ×4 |
When the domains were registered · a ring = several bought within days of each other
2026-08-312026-09-04
| Registered | Site |
|---|---|
| 2026-08-31 · in a wave | vaultpay-verify.com |
| 2026-09-02 · in a wave | vault-pay.co |
| 2026-09-03 · in a wave | vaultpay-secure.net |
| 2026-09-04 · in a wave | vaultpay-login.com |
Evidence per site · which site has which tie
| Site | registrant | tracking id | data sink | certificate | ip | kit | batch | kit look |
|---|---|---|---|---|---|---|---|---|
| vault-pay.co | ops@affnet-mail.example | UA-777001-1 | collect.affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | page 67392ce2a1 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot 8c3b6f563c |
| vaultpay-login.com | ops@affnet-mail.example | UA-777001-1 | collect.affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | page 67392ce2a1 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot 8c3b6f563c |
| vaultpay-secure.net | ops@affnet-mail.example | UA-777001-1 | collect.affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | page 67392ce2a1 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot 8c3b6f563c |
| vaultpay-verify.com | ops@affnet-mail.example | UA-777001-1 | collect.affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | page 67392ce2a1 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot 8c3b6f563c |
Also in common, but weak · they never group sites
| Kind | Value | Sites |
|---|---|---|
| the same favicon | 1401845590 | 4 |
| the same registrar | Mock Registrar LLC | 4 |
| the same name server | ns1.mock-dns.example | 4 |
| the same name server | ns2.mock-dns.example | 4 |
Confidence is the weakest tie that holds the group together. Every tie has a weight: how likely it is that two sites sharing it are one operation. A server on a CDN is no evidence; a registrar or a name server never ties two sites on its own. This report was generated from the evidence BrandWatch holds today; searching for more sites of this operation is a separate step the analyst starts.