9 open38 to send

FINDINGS · 4 confirmed phishing

jk move · x select · c confirm · d dismiss · / search ·

A finding is a look-alike that scored Medium or higher and waits for an analyst's verdict. Everything below the threshold stays on the Watchlist and is re-checked on a schedule.

0awaiting verdict 0critical 0high 0medium 0new in 24h 0confirmed 0dismissed
All brands 39 ShopNova 28ShopNova · Israel 2CoinPilot 7VaultPay 4
Reset
ScreenshotSeverityHostScoreConf.SignalsStateFound
screenshot of vaultpay-login.com critical vaultpay-login.com
domain name · found by Look-alike names, Analyst URL scan · network · timeline
 87 VT 7
100
 identical favicon looks like the real site shares a server with phishing already flagged as phishing +15 more confirmed phishing
screenshot of vaultpay-verify.com critical vaultpay-verify.com
domain name · found by Look-alike names, Analyst URL scan · network · timeline
 77 VT —
100
 identical favicon looks like the real site shares a server with phishing linked to a mapped attacker +12 more confirmed phishing
screenshot of vaultpay-secure.net critical vaultpay-secure.net
domain name · found by Analyst URL scan · network · timeline
 77 VT —
90
 identical favicon looks like the real site shares a server with phishing same tracking ID as phishing +11 more confirmed phishing
screenshot of vault-pay.co critical vault-pay.co
domain name · found by Analyst URL scan · network · timeline
 75 VT —
90
 identical favicon looks like the real site shares a server with phishing same tracking ID as phishing +10 more confirmed phishing
4 in total
Download these 4: CSV · JSON (the same filters, every page)

Statistics · across open findings of the chosen brand

show ▾hide ▴

Open by severity · Medium ≥ 25 · High ≥ 50 · Critical ≥ 75

critical1

Why things are flagged · signals fired per group across open findings

Behaviour
25
Visual
25
Infrastructure
16
Identity
7
Reputation
3
Freshness
2

Risk score distribution

0 10 20 30 40 50 60 470 180 90

New findings · 14 days

14 days agotoday · 0

Surface · where the brand appears: domain name · subdomain · URL path

■ domain name 5  

Top fired signals

page title claims the brand
5
identical favicon
5
looks 85%+ like the real site
5
looks like the real site
5
same colours
5
cloned login form
5
asks for a password
5
brand words in the text
5
urgent lure wording
5
sends data elsewhere
5

Every signal belongs to one of 7 groups, and each group has a points cap so correlated evidence is not counted twice. Hover a signal for its evidence and points. How scoring works →