13
confirmed sites
97%
confidence · certain
Phishing kit
what it does
2026-02-25 → 2026-09-30
domains registered · in waves
6
ways to stop it
Because the same affiliate id on the brand's own site atid=51803 95%the same registrant ops@affnet-mail.example 90%the same analytics / pixel ID UA-777001-1 90%the same place the stolen data is sent collect.affnet-mail.example 90%
One group of attackers, 3 brands: CoinPilot ×7, VaultPay ×4, ShopNova ×2. It does more than one thing: 7 × affiliate fraud, 6 × phishing kit. 9 of 13 domains were registered within 5 day(s) (2026-08-31 → 2026-09-04): a batch, not a coincidence. 6/13 credential form.
- 6/13 credential form
- 4/13 external form action
How to stop it · the shortest way, first
1
Ask CoinPilot's affiliate team to ban atid=51803
7 domains send their visitors to the real site with atid=51803. Banning that id and withholding its commission ends the reward for all of them at once.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io
2
Report collect.affnet-mail.example, where the stolen data goes
A single takedown of the collecting host stops every kit that posts to it.
vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
3
Report the redirect host go-linkz.click
7 sites forward visitors through go-linkz.click. Its abuse contact can close every short link.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io
4
One bulk abuse report to Mock Registrar LLC
13 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io, shopnowa.com, shoqnova.com, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
5
Report the hosting provider Fast VPS LLC
The provider can disable the servers that host these pages.
coin-pilot.io, coinpilott.io, coinpllot.io, shopnowa.com, shoqnova.com, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com
6
Report the hosting provider Mock Hosting LLC
The provider can disable the servers that host these pages.
coinpilot-bot.io, coinplot.io, cooinpilot.io, koinpilot.io
The sites · 13
| Site | Severity | Registered | Registrar | Server(s) | Hosting | Name servers | Ends on |
|---|---|---|---|---|---|---|---|
| coin-pilot.io atid=51803 |
critical | 2026-02-26 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpilot-bot.io atid=51803 |
critical | 2026-02-25 | Mock Registrar LLC | 198.51.100.79 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpilott.io atid=51803 |
critical | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinpllot.io atid=51803 |
critical | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| coinplot.io atid=51803 |
critical | 2026-09-02 | Mock Registrar LLC | 198.51.100.78 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| cooinpilot.io atid=51803 |
critical | 2026-09-01 | Mock Registrar LLC | 198.51.100.79 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| koinpilot.io atid=51803 |
critical | 2026-09-02 | Mock Registrar LLC | 198.51.100.78 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | www.coinpilot.io |
| shopnowa.com | critical | 2026-09-22 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnowa.com |
| shoqnova.com | critical | 2026-09-30 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shoqnova.com |
| vault-pay.co | critical | 2026-09-02 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vault-pay.co |
| vaultpay-login.com | critical | 2026-09-04 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-login.com |
| vaultpay-secure.net | critical | 2026-09-03 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-secure.net |
| vaultpay-verify.com | critical | 2026-08-31 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | vaultpay-verify.com |
Who is with whom · 7 clusters
13 of the 13 sites are on one server. Sites that share exactly the same things are shown together, so a long list of links reads as one line.
coin-pilot.iocoinpilot-bot.iocoinpilott.iocoinpllot.iocoinplot.iocooinpilot.iokoinpilot.ioshopnowa.comshoqnova.comvault-pay.covaultpay-login.comvaultpay-secure.netvaultpay-verify.com
13 sites share
certificate bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb 80%server 198.51.100.77 80%
coin-pilot.iocoinpilot-bot.iocoinpilott.iocoinpllot.iocoinplot.iocooinpilot.iokoinpilot.iovault-pay.covaultpay-login.comvaultpay-secure.netvaultpay-verify.com
11 sites share
registrant ops@affnet-mail.example 90%
coinpilott.iocoinpllot.iocoinplot.iocooinpilot.iokoinpilot.iovault-pay.covaultpay-login.comvaultpay-secure.netvaultpay-verify.com
9 sites share
registered together Mock Registrar LLC · 2026-08-31 → 2026-09-04 30%
coin-pilot.iocoinpilot-bot.iocoinpilott.iocoinpllot.iocoinplot.iocooinpilot.iokoinpilot.io
7 sites share
affiliate atid=51803 95%server ×2 198.51.100.78, 198.51.100.79 80%redirects via go-linkz.click 60%page code page 2cefb68bc4 60%page look screenshot a8696e721b 30%
vault-pay.covaultpay-login.comvaultpay-secure.netvaultpay-verify.com
4 sites share
analytics id UA-777001-1 90%data goes to collect.affnet-mail.example 90%page code page 67392ce2a1 60%page look screenshot 8c3b6f563c 30%
coin-pilot.iocoinpilot-bot.io
2 sites share
registered together Mock Registrar LLC · 2026-02-25 → 2026-02-26 30%
shopnowa.comshoqnova.com
2 sites share
page look screenshot be37c1cd4c 30%
Who against whom
How sure we are that two sites are one operation (the darker the cell, the surer). The number is shown from 75%, where two sites count as one operation.
coin-pilot.io | coinpilot-bot.io | coinpilott.io | coinpllot.io | coinplot.io | cooinpilot.io | koinpilot.io | shopnowa.com | shoqnova.com | vault-pay.co | vaultpay-login.com | vaultpay-secure.net | vaultpay-verify.com | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| coin-pilot.io | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | 100 | |
| coinpilot-bot.io | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | 100 | |
| coinpilott.io | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | 100 | |
| coinpllot.io | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | 100 | |
| coinplot.io | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | 100 | |
| cooinpilot.io | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | 100 | |
| koinpilot.io | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | 100 | |
| shopnowa.com | 96 | 96 | 96 | 96 | 96 | 96 | 96 | 97 | 96 | 96 | 96 | 96 | |
| shoqnova.com | 96 | 96 | 96 | 96 | 96 | 96 | 96 | 97 | 96 | 96 | 96 | 96 | |
| vault-pay.co | 100 | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | |
| vaultpay-login.com | 100 | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | |
| vaultpay-secure.net | 100 | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 | |
| vaultpay-verify.com | 100 | 100 | 100 | 100 | 100 | 100 | 100 | 96 | 96 | 100 | 100 | 100 |
Who shares what · every shared server, certificate, registrant and more
Same server (address) · 3
| Value | Strength | Shared by |
|---|---|---|
| 198.51.100.77 Fast VPS LLC · hoster |
80% proof |
13 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io, shopnowa.com, shoqnova.com, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
| 198.51.100.78 Mock Hosting LLC · hoster |
80% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| 198.51.100.79 Mock Hosting LLC · hoster |
80% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
TLS certificates · 1
| Value | Strength | Shared by |
|---|---|---|
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 80% proof |
13 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io, shopnowa.com, shoqnova.com, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Analytics / pixel IDs · 1
| Value | Strength | Shared by |
|---|---|---|
| UA-777001-1 | 90% proof |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Registrants · 1
| Value | Strength | Shared by |
|---|---|---|
| ops@affnet-mail.example | 90% proof |
11 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Affiliate ids · 1
| Value | Strength | Shared by |
|---|---|---|
| atid=51803 | 95% proof |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Redirect hosts · 1
| Value | Strength | Shared by |
|---|---|---|
| go-linkz.click | 60% a hint |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
Where the stolen data goes · 1
| Value | Strength | Shared by |
|---|---|---|
| collect.affnet-mail.example | 90% proof |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Name servers · 2
| Value | Strength | Shared by |
|---|---|---|
| ns1.mock-dns.example | 10% common |
13 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io, shopnowa.com, shoqnova.com, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
| ns2.mock-dns.example | 10% common |
13 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io, shopnowa.com, shoqnova.com, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Registrars · 1
| Value | Strength | Shared by |
|---|---|---|
| Mock Registrar LLC | 10% common |
13 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io, shopnowa.com, shoqnova.com, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Bought together · 2
| Value | Strength | Shared by |
|---|---|---|
| Mock Registrar LLC · 2026-08-31 → 2026-09-04 | 30% a hint |
9 sites coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io, vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
| Mock Registrar LLC · 2026-02-25 → 2026-02-26 | 30% a hint |
2 sites coin-pilot.io, coinpilot-bot.io |
Same page code · 2
| Value | Strength | Shared by |
|---|---|---|
| page 2cefb68bc4 | 60% a hint |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| page 67392ce2a1 | 60% a hint |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
Pages that look the same · 3
| Value | Strength | Shared by |
|---|---|---|
| screenshot a8696e721b | 30% a hint |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| screenshot 8c3b6f563c | 30% a hint |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
| screenshot be37c1cd4c | 30% a hint |
2 sites shopnowa.com, shoqnova.com |
Favicons · 3
| Value | Strength | Shared by |
|---|---|---|
| 1130316202 | 10% common |
7 sites coin-pilot.io, coinpilot-bot.io, coinpilott.io, coinpllot.io, coinplot.io, cooinpilot.io, koinpilot.io |
| 1401845590 | 10% common |
4 sites vault-pay.co, vaultpay-login.com, vaultpay-secure.net, vaultpay-verify.com |
| -2029202433 | 10% common |
2 sites shopnowa.com, shoqnova.com |
Toolkit · what the attacker uses
| Kind | What |
|---|---|
| Registrars | Mock Registrar LLC ×13 |
| Hosting | Fast VPS LLC (hoster) ×9Mock Hosting LLC (hoster) ×4 |
| Redirect hosts | go-linkz.click ×7 |
| Name servers | ns1.mock-dns.example ×13ns2.mock-dns.example ×13 |
| Certificate issuers | C=US O=Mock Trust Services CN=MT1 ×13 |
When the domains were registered · a ring = several bought within days of each other
2026-02-252026-09-30
| Registered | Site |
|---|---|
| 2026-02-25 · in a wave | coinpilot-bot.io |
| 2026-02-26 · in a wave | coin-pilot.io |
| 2026-08-31 · in a wave | vaultpay-verify.com |
| 2026-09-01 · in a wave | cooinpilot.io |
| 2026-09-02 · in a wave | coinplot.io |
| 2026-09-02 · in a wave | koinpilot.io |
| 2026-09-02 · in a wave | vault-pay.co |
| 2026-09-03 · in a wave | coinpilott.io |
| 2026-09-03 · in a wave | coinpllot.io |
| 2026-09-03 · in a wave | vaultpay-secure.net |
| 2026-09-04 · in a wave | vaultpay-login.com |
| 2026-09-22 | shopnowa.com |
| 2026-09-30 | shoqnova.com |
Evidence per site · which site has which tie
| Site | affiliate id | registrant | tracking id | data sink | certificate | ip | redirector | kit | batch | kit look |
|---|---|---|---|---|---|---|---|---|---|---|
| coin-pilot.io | atid=51803 | ops@affnet-mail.example | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-02-25 → 2026-02-26 | screenshot a8696e721b |
| coinpilot-bot.io | atid=51803 | ops@affnet-mail.example | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-02-25 → 2026-02-26 | screenshot a8696e721b |
| coinpilott.io | atid=51803 | ops@affnet-mail.example | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot a8696e721b |
| coinpllot.io | atid=51803 | ops@affnet-mail.example | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot a8696e721b |
| coinplot.io | atid=51803 | ops@affnet-mail.example | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot a8696e721b |
| cooinpilot.io | atid=51803 | ops@affnet-mail.example | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot a8696e721b |
| koinpilot.io | atid=51803 | ops@affnet-mail.example | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77, 198.51.100.78, 198.51.100.79 | go-linkz.click | page 2cefb68bc4 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot a8696e721b |
| shopnowa.com | · | · | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | · | · | · | screenshot be37c1cd4c |
| shoqnova.com | · | · | · | · | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | · | · | · | screenshot be37c1cd4c |
| vault-pay.co | · | ops@affnet-mail.example | UA-777001-1 | collect.affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | · | page 67392ce2a1 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot 8c3b6f563c |
| vaultpay-login.com | · | ops@affnet-mail.example | UA-777001-1 | collect.affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | · | page 67392ce2a1 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot 8c3b6f563c |
| vaultpay-secure.net | · | ops@affnet-mail.example | UA-777001-1 | collect.affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | · | page 67392ce2a1 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot 8c3b6f563c |
| vaultpay-verify.com | · | ops@affnet-mail.example | UA-777001-1 | collect.affnet-mail.example | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | · | page 67392ce2a1 | Mock Registrar LLC · 2026-08-31 → 2026-09-04 | screenshot 8c3b6f563c |
Also in common, but weak · they never group sites
| Kind | Value | Sites |
|---|---|---|
| the same favicon | -2029202433 | 2 |
| the same favicon | 1130316202 | 7 |
| the same favicon | 1401845590 | 4 |
| the same registrar | Mock Registrar LLC | 13 |
| the same name server | ns1.mock-dns.example | 13 |
| the same name server | ns2.mock-dns.example | 13 |
Confidence is the weakest tie that holds the group together. Every tie has a weight: how likely it is that two sites sharing it are one operation. A server on a CDN is no evidence; a registrar or a name server never ties two sites on its own. This report was generated from the evidence BrandWatch holds today; searching for more sites of this operation is a separate step the analyst starts.