account-review-center.com
Registered 6 days ago. Copies VaultPay's favicon, homepage and login form, asks for a password and sends what you type to another server. It shares infrastructure with phishing BrandWatch already mapped.
192.0.2.78
registrar Mock Registrar LLC
What do I do · review the evidence below, then give a verdict
High risk and complete evidence → confirm, then draft the takedown.
It is advertised: 2 Facebook / Instagram ads send people here — report them to Meta (Ads tab).
Notes · for you and the next analyst — kept with the finding, never edited, also in Activity
No notes yet.
Advertised on Facebook / Instagram · 2 ads that use VaultPay's name and send people to this site
Found in Meta's Ad Library. The ad is how victims reach the kit: reporting it stops new visitors even before the site is taken down.
Explain Finding — why it was flagged · every signal, its points and the evidence behind it
| Signal | Group | Points | Evidence |
|---|---|---|---|
| identical favicon favicon_exact | Visual | +22 | favicon mmh3 1401845590 equals the brand's favicon hash |
| looks like the real site screenshot_similarity_ge_90 | Visual | +18 | homepage screenshot is 100% similar to the brand's (pHash) |
| linked to a mapped attacker linked_to_known_campaign | Infrastructure | +15 | shares infrastructure with an investigated campaign of this brand |
| same tracking ID as phishing tracking_id_shared | Infrastructure | +15 | tracking id UA-777001-1 also present on known phishing pages |
| asks for a password credential_form | Behaviour | +14 | page contains a password field |
| sends data elsewhere external_form_action | Behaviour | +12 | credential/payment form posts to another host: https://collect.affnet-mail.example/p |
| cloned login form login_dom_similarity | Visual | +12 | login form markup is 100% identical to the brand's |
| registered < 7 days ago age_lt_7d | Freshness | +10 | domain registered 6 day(s) ago |
show all 14 signals, bonuses
| page title claims the brand title_claims_brand | Behaviour | +10 | the page calls itself the brand: <title>VaultPay — Sign in</title> |
| looks 85%+ like the real site looks_like_brand_ge_85 | Visual | +8 | the page looks 100% like vaultpay's real site: above 85% the risk is very high |
| registered < 30 days ago age_lt_30d | Freshness | +6 | domain registered 6 days ago |
| brand words in the text brand_keywords_in_content | Behaviour | +6 | brand terms in content: money, send, vaultpay |
| urgent lure wording lure_language | Behaviour | +6 | lure phrases: confirm your identity |
| same colours palette_match | Visual | +5 | 100% of the page's dominant colours match the brand's |
| combination bonus | cluster | +15 | screenshot_similarity_ge_90 + credential_form + external_form_action |
How the score adds up
⚙ deterministic · versioned Raw 105 of 150 → normalised to 75 / 100 · severity raised to critical by the rule “pixel-perfect clone with a login form (favicon + screenshot + password form)”.
Thresholds: Medium 25 · High 50 · Critical 75 · scoring v7-f1ba3ebf
Other rules that fired: a days-old look-alike asking for a password (≥ high); titled as the brand and asking for a password (≥ high); a login page tied to an already-mapped attacker (≥ high); looks like brand verdict (≥ critical)
open the arithmetic ↗ — this site's section of the scan trace
Group caps ? · stop correlated evidence from double counting
Confidence ? · 100%
| Breadth (4 independent groups) | +60 |
| Hard confirmers favicon_exact, linked_to_known_campaign | +30 |
| Evidence completeness | +15 |
| Provider agreement | +0 |
| Unavailable evidence | 0 |
| Single weak signal | 0 |
Suspect vs. official similarity 100%
Cloaking multi-probe ? ⚙ Tier 3/4 multi-probe
| Probe | Profile | Login form | Diverged | Note |
|---|---|---|---|---|
| bot | bot | yes | same | |
| param | datacenter | yes | same | |
| referer | referer | yes | same | |
| residential | residential | yes | same |
Fetched several ways — a crawler user-agent, a victim-style link (?email=), a Google referer, a phone (when chosen in Settings → Proxy) and a real home or phone-network IP (Tier 4). Residential (Tier 4): used. Residential IPs are used to look, never to interact.
VirusTotal · security vendors
Server reputation · AbuseIPDB
Categories
JARM
Engines flagged first
| Engine | Category | Result | Method |
|---|---|---|---|
| BitDefender | harmless | clean | blacklist |
| CRDF | harmless | clean | blacklist |
| ESET | harmless | clean | blacklist |
| Fortinet | harmless | clean | blacklist |
| Google Safebrowsing | harmless | clean | blacklist |
| Kaspersky | harmless | clean | blacklist |
| Netcraft | harmless | clean | blacklist |
| OpenPhish | harmless | clean | blacklist |
| Phishtank | harmless | clean | blacklist |
| Quttera | harmless | clean | blacklist |
| Sophos | harmless | clean | blacklist |
| Webroot | harmless | clean | blacklist |
Look it up elsewhere
Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.
Registration data (RDAP)
- Name
- account-review-center.com
- registration
- 2026-10-12
- Status
- —
- DNSSEC
- —
Registrar & abuse contact
- Registrar
- Mock Registrar LLC
- Abuse email
- —
- registrant email
- ops@affnet-mail.example
Nameservers
—Current WHOIS record (VirusTotal)
WHOIS history · every WHOIS snapshot WhoisXML has recorded for account-review-center.com
Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.
First registered
Snapshots
Owners seen
Registrars
Owner details now
Same owner e-mail on other domains in this workspace
Found in other domains' WHOIS history and in the WHOIS evidence of your scans — no extra API call. One operator, several kits.
TIMELINE
- 2026-10-12Registered by ops@affnet-mail.examplevia Mock Registrar LLC · first WHOIS snapshot 2026-10-13
SNAPSHOTS · CHANGED FIELDS MARKED
| Seen | Registrar | Registrant | Created · expires |
|---|---|---|---|
| 2026-10-13 | Mock Registrar LLC | ops@affnet-mail.example | 2026-10-12 · 2027-10-12 |
raw WHOIS · 2026-10-13Domain Name: ACCOUNT-REVIEW-CENTER.COM
Registrar: Mock Registrar LLC
Creation Date: 2026-10-12T00:00:00Z
Updated Date: 2026-10-13T00:00:00Z
Registry Expiry Date: 2027-10-12T00:00:00Z
Registrant Organization:
Registrant Name:
Registrant Email: ops@affnet-mail.example
Name Server: NS1.MOCK-DNS.EXAMPLE
Name Server: NS2.MOCK-DNS.EXAMPLE | |||
Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .
DNS records source: VirusTotal
A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).
| Type | TTL | Value |
|---|---|---|
| A | 300 | 192.0.2.78 |
| AAAA | 300 | 2001:db8::d357 |
| NS | 21600 | ns1.mock-dns.example |
| NS | 21600 | ns2.mock-dns.example |
| MX | 3600 | mail.account-review-center.com prio 10 |
| SOA | 1800 | ns1.mock-dns.example rname hostmaster.account-review-center.com · serial 2026100801 |
HTTPS certificate from VirusTotal
- Common name
- account-review-center.com
- Issuer
- C=US O=Mock Trust Services CN=MT1
- Valid
- 2026-09-20 00:00:00 → 2026-12-19 00:00:0032% of the validity period elapsed
- Alt names (2)
- account-review-center.com www.account-review-center.com
- SHA-256
- 485db7e1a122559902294f93a4c5eebe64519dfcffe9fc68b36f2bafc8640dfa · crt.sh ↗
serial, signature, key, TLS and the full certificate
- Subject
- CN=account-review-center.com
- Serial
- 1182c1d5
- Signature
- sha256ECDSA
- Public key
- EC secp256r1
- SHA-1
- a64aff53aa087d0712fbc30299edeed170337f57
192.0.2.78
Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days
SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)
COMMUNICATING FILES not fetched yet
IP WHOIS record
engine verdicts for this IP (12)
| Engine | Category | Result |
|---|---|---|
| BitDefender | harmless | clean |
| CRDF | harmless | clean |
| ESET | harmless | clean |
| Fortinet | harmless | clean |
| Google Safebrowsing | harmless | clean |
| Kaspersky | harmless | clean |
| Netcraft | harmless | clean |
| OpenPhish | harmless | clean |
| Phishtank | harmless | clean |
| Quttera | harmless | clean |
| Sophos | harmless | clean |
| Webroot | harmless | clean |
urlscan.io scan
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-18 20:00
domains contacted by the page (2)
Similar sites 4
Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.
Same page (identical document hash) 4hash:51942631860784da3f8a66a6ef3ad76477be5f8af34c9c1cdb60b752def0e02d
the same HTML served elsewhere — the same phishing kit
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-09-20 | — | shopn0va.com |
urlscan ↗ · VT ↗ | shopn0va.com - Sign in |
| 2026-09-19 | — | shopnova-login.com |
urlscan ↗ · VT ↗ | shopnova-login.com - Sign in |
| 2026-09-18 | — | secure-shopnova.com |
urlscan ↗ · VT ↗ | secure-shopnova.com - Sign in |
| 2026-09-12 | — | shopnova.co |
urlscan ↗ · VT ↗ | shopnova.co - Sign in |
Same server 0page.ip:203.0.113.66
other pages scanned on the same IP
noneSame brand name 0page.domain:*vaultpay*
domains containing the brand name
nonePassive DNS replication 1
Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.
| Date resolved | Detections (IP) | IP |
|---|---|---|
| 2026-10-01 | 3/ 92 | 192.0.2.78 |
Subdomains 3
| Host | Detections |
|---|---|
| login.account-review-center.com | 2/ 92 |
| mail.account-review-center.com | 0/ 90 |
| www.account-review-center.com | 0/ 90 |
Communicating files 0 not fetched yet
Malware samples that contacted this domain while being analysed.
Historical WHOIS · VirusTotal 1
- Registrant Organization
- REDACTED FOR PRIVACY
- Registrant Country
- US
- Name Server
- NS1.MOCK-DNS.EXAMPLE
Historical certificates 0 VT · 1 CT not fetched yet
CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains
| Not before | Names | Issuer |
|---|---|---|
| 2026-09-01 | mail0.account-review-center.com-cdn.net | Mock CA |
Observation timeline
- 2026-10-18 17:10:04 · HTTP 200 · state new · datacenter · content changed · ad75c5119ed5 · screenshot
first seen 2026-10-18 17:10 · scans 1 · next 2026-10-19 05:10 · candidate state flagged · WHOIS history →
Score history
| When | Score | Severity | Confidence | Version |
|---|---|---|---|---|
| 2026-10-18 17:10:05 current | 75 | critical | 100% | v7-f1ba3ebf |
Evidence · chain of custody ? ⚙ immutable · DB-enforced
Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.
| Observed (UTC) | Type | Role | Source | SHA-256 | Details | |
|---|---|---|---|---|---|---|
| 2026-10-18 17:10:05 | http · residential view | supporting | mock:playwright | ad75c5119ed5552a | probe: residential status: 200 content_sha256: ad75c5119ed5552a7f95de05ed4… +3 | |
| 2026-10-18 17:10:05 | http · referer view | supporting | mock:playwright | ad75c5119ed5552a | probe: referer status: 200 content_sha256: ad75c5119ed5552a7f95de05ed4… +3 | |
| 2026-10-18 17:10:05 | http · param view | supporting | mock:playwright | ad75c5119ed5552a | probe: param status: 200 content_sha256: ad75c5119ed5552a7f95de05ed4… +3 | |
| 2026-10-18 17:10:05 | http · bot view | supporting | mock:playwright | ad75c5119ed5552a | probe: bot status: 200 content_sha256: ad75c5119ed5552a7f95de05ed4… +3 | |
| 2026-10-18 17:10:04 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-18 17:10:04 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-18 17:10:04 | reputation | context | mock:virustotal | — | status: unknown | |
| 2026-10-18 17:10:04 | whois | primary | mock:rdap | — | status: positive | |
| 2026-10-18 17:10:04 | ssl | context | mock:playwright | — | fingerprint_sha256: 0badc0de0badc0de0badc0de0ba… | |
| 2026-10-18 17:10:04 | favicon | primary | mock:playwright | 244590d4fe2a7ac7 | mmh3: 1401845590 phash: 80e45b5b26e663b6 | artifact |
| 2026-10-18 17:10:04 | screenshot · datacenter view | primary | mock:playwright | 3d9ad1e22b239354 | phash: 8c3b6f563c5e520c dhash: 4a52b3b7a7c4e666 palette: ['#4e394c', '#97c466', '#79… | artifact |
| 2026-10-18 17:10:04 | html · datacenter view | primary | mock:playwright | ad75c5119ed5552a | title: VaultPay — Sign in forms: 1 parked: False | artifact |
show all 14 evidence rows from 1 scan(s)
| 2026-10-18 17:10:04 | http | supporting | mock:playwright | ad75c5119ed5552a | status: 200 final_url: https://account-review-cent… content_type: text/html; charset=utf-8 | |
| 2026-10-18 17:10:04 | dns | supporting | mock:local_dns | — | status: positive |
Advisory opinions · shown for context, never part of the score ⚙ AI advisory · JSON schema
AI · mock:openai phishing impersonating VaultPay · 97% — credential form; lure language; form posts off-site; page presents itself as VaultPay
classifier · ml-5edcdd68-20 P(phishing) = 89% (cross-validated accuracy 94%)