Skip to content
What we see

What the scams look like.

Totals from everything Vatra Sentinel has flagged, refreshed every minute. Campaigns and the activity chart cover the last 24 hours.
How it works

Three checks, each on what the last one flagged.

Most names stop at the first check. Only the suspicious ones cost a network call, and only the strongest reach VAKYN.

  1. 01

    Name and certificate

    Every new name is compared with about 9,800 brands, looking for typos, lookalike letters and lure words such as login or refund. This takes microseconds and makes no network calls.

    764.9M names scored

  2. 02

    Registration and DNS

    For suspicious names, Vatra looks up the registration (age, registrar, status), the DNS records and the network that hosts the site.

    5M checked deeper

  3. 03

    VAKYN verdict

    The strongest cases go to VAKYN, a decision model. It answers eight questions about the site, such as what it is after and who it targets, and says how sure it is of each.

    833K judged by VAKYN

The score

How a domain gets its score.

Each reason Vatra finds is worth points, more for reasons seen far more often on scam sites than on ordinary ones. Some reasons take points away. The total, from 0 to 100, sets the level.

A real case from the last day

outlook.m365-onauthservices.com

  1. registered 2 days ago+2626
  2. subdomain label "outlook" contains brand keyword "outlook" (registered domain "m365-onauthservices.com"), lure "service" (common-word brand)+2551
  3. registrar NICENIC INTERNATIONAL GROUP CO., LIMITED+2071
  4. no mail servers, AS200051 ASRIZKI on Spamhaus ASN-DROP, same IP hosts 6 other flagged domain(s)+1586
  5. lure words: service+389
  6. .com abuse prior−287
  7. registered for the minimum one year+289
  8. digit run+190
  9. certificate covers only this name+191
  • Name and certificate
  • Registration and DNS
  • VAKYN verdict
ScoreCritical91/ 100

What each level means

  1. Clean 0–29Not stored.
  2. Low 30–49about 2 in 100Usually one reason, such as a brand name inside the domain.
  3. Medium 50–69about 12 in 100Usually a brand and a lure word in the name.
  4. High 70–89about 1 in 2Usually a suspicious name plus a new registration or abused hosting.
  5. Critical 90–100about 9 in 10Strong reasons from several checks at once.

Rough odds of a scam, estimated from the weights; not measured on confirmed cases.

Flagged so far

2.6M of 764.9M names scored reached Low or higher (0.34%).

Low
1,598,716
62.1% of flagged
Medium
906,110
35.2% of flagged
High
61,247
2.4% of flagged
Critical
7,154
0.3% of flagged
  1. 01

    Strong reasons weigh most

    Registered less than a day ago adds 32. Lookalike letters in a brand name add up to 50, a misspelled brand up to 30, a lure word like login next to a brand 15.

  2. 02

    Some reasons take points away

    A domain registered more than a year ago loses 15, a parked domain 7. Endings like .de, .uk and .nl lose 10 to 12, because scammers rarely use them.

  3. 03

    Overlapping reasons count once

    When a name matches a brand in several ways, only the strongest match counts. The name's shape adds at most 8, and DNS and hosting at most 15, however many small signs there are.

  4. 04

    VAKYN explains, it doesn't score

    Its eight answers say what the site is and who it targets. They add no points: VAKYN reads the same evidence, so counting it again would count it twice.

Where flagged sites are hosted.

Hosting country of each flagged site, not where the people behind it are.

Fiji: 0Tanzania: 2W. Sahara: 0Canada: 123United States of America: 65,630Kazakhstan: 63Uzbekistan: 11Papua New Guinea: 0Indonesia: 190Argentina: 7Chile: 0Dem. Rep. Congo: 0Somalia: 0Kenya: 32Sudan: 0Chad: 0Haiti: 0Dominican Rep.: 0Russia: 17,951Bahamas: 0Falkland Is.: 0Norway: 12Greenland: 0Fr. S. Antarctic Lands: 0Timor-Leste: 0South Africa: 35Lesotho: 0Mexico: 0Uruguay: 0Brazil: 71Bolivia: 0Peru: 0Colombia: 0Panama: 100Costa Rica: 0Nicaragua: 0Honduras: 0El Salvador: 0Guatemala: 0Belize: 0Venezuela: 0Guyana: 0Suriname: 0France: 805Ecuador: 0Puerto Rico: 0Jamaica: 0Cuba: 0Zimbabwe: 0Botswana: 0Namibia: 0Senegal: 0Mali: 0Mauritania: 0Benin: 0Niger: 0Nigeria: 0Cameroon: 1Togo: 0Ghana: 0Côte d'Ivoire: 0Guinea: 0Guinea-Bissau: 0Liberia: 0Sierra Leone: 0Burkina Faso: 0Central African Rep.: 0Congo: 0Gabon: 0Eq. Guinea: 0Zambia: 0Malawi: 0Mozambique: 0eSwatini: 0Angola: 0Burundi: 0Israel: 257Lebanon: 0Madagascar: 0Palestine: 0Gambia: 0Tunisia: 1Algeria: 2Jordan: 0United Arab Emirates: 26,161Qatar: 0Kuwait: 0Iraq: 3Oman: 0Vanuatu: 0Cambodia: 0Thailand: 22Laos: 0Myanmar: 1Vietnam: 44North Korea: 0South Korea: 25Mongolia: 0India: 47Bangladesh: 86Bhutan: 0Nepal: 5Pakistan: 0Afghanistan: 0Tajikistan: 40Kyrgyzstan: 4Turkmenistan: 0Iran: 21Syria: 0Armenia: 7Sweden: 43Belarus: 13Ukraine: 78Poland: 73Austria: 43Hungary: 26Moldova: 176Romania: 115Lithuania: 56Latvia: 77Estonia: 129Germany: 5,179Bulgaria: 21Greece: 0Turkey: 94Albania: 5Croatia: 2Switzerland: 25Luxembourg: 6Belgium: 9Netherlands: 2,455Portugal: 2Spain: 58Ireland: 5New Caledonia: 0Solomon Is.: 0New Zealand: 19Australia: 915Sri Lanka: 0China: 489Taiwan: 9Italy: 119Denmark: 20United Kingdom: 879Iceland: 20Azerbaijan: 0Georgia: 52Philippines: 0Malaysia: 143Brunei: 0Slovenia: 9Finland: 21Slovakia: 7Czechia: 25Eritrea: 0Japan: 50Paraguay: 0Yemen: 0Saudi Arabia: 13N. Cyprus: 1,249Cyprus: 1,249Morocco: 0Egypt: 1Libya: 3Ethiopia: 0Djibouti: 0Somaliland: 0Uganda: 0Rwanda: 1Bosnia and Herz.: 2Macedonia: 0Serbia: 4Montenegro: 0Kosovo: 0Trinidad and Tobago: 0S. Sudan: 0Singapore: 268,321Hong Kong: 3,493Macao: 1Seychelles: 241British Virgin Islands: 33Saint Kitts and Nevis: 12Dominica: 16Antigua and Barbuda: 3
Singapore 268,321United States 65,630United Arab Emirates 26,161Russia 17,951Germany 5,179
Campaigns

One actor, many domains.

Flagged domains from the last 24 hours that share a server, the same nameservers, or a registrar and registration day.

VAKYN verdict

What the scams are after.

Counted from 815,646 VAKYN verdicts.

Kind of scam

  1. Credential phishing675,678
  2. Gambling91,506
  3. Payment fraud29,490
  4. Crypto theft10,031
  5. Malware download3,144
  6. Investment scam2,419
  7. Fake shop2,253
  8. Unclear986

Who they target

  1. Social media users277,421
  2. General public193,535
  3. Bank customers140,956
  4. Gamers104,901
  5. Shoppers44,205
  6. Crypto holders31,229
  7. Employees16,163
  8. Developers4,589

Why domains get flagged

  1. Brand name inside the domain800,090
  2. Certificate for this one name only793,244
  3. Odd-looking name (hyphens, digits, length)696,808
  4. Lure words such as login, verify, refund490,664
  5. Suspicious DNS or hosting316,243
  6. Domain ending often used for abuse313,261
  7. On a free hosting platform190,600
  8. Exact brand name on a new domain184,960

Domain endings and free hosts used most

  1. .ph362,679
  2. .com.ph143,536
  3. .pages.dev140,479
  4. .com101,528
  5. .top41,226
  6. .ru34,571
  7. .net.ph17,374
  8. .workers.dev15,511

Who issues the certificates

  1. Let's Encrypt412,977,507
  2. Google Trust Services163,864,800
  3. Amazon94,378,436
  4. GoDaddy.com27,294,271
  5. DigiCert Inc25,160,520
  6. ZeroSSL GmbH21,632,986
  7. Microsoft Corporation18,640,075
  8. SSL Corporation16,845,230

Counts every certificate read, flagged or not.

Activity

The last 24 hours.

Flagged domains per hour, by level.

2026-10-29 09:00 UTC: Medium 230, High 28, Critical 22026-10-29 10:00 UTC: Medium 650, High 50, Critical 72026-10-29 11:00 UTC: Medium 714, High 41, Critical 42026-10-29 12:00 UTC: Medium 816, High 49, Critical 12026-10-29 13:00 UTC: Medium 900, High 33, Critical 22026-10-29 14:00 UTC: Medium 646, High 33, Critical 62026-10-29 15:00 UTC: Medium 535, High 66, Critical 42026-10-29 16:00 UTC: Medium 459, High 73, Critical 72026-10-29 17:00 UTC: Medium 455, High 30, Critical 32026-10-29 18:00 UTC: Medium 466, High 38, Critical 52026-10-29 19:00 UTC: Medium 372, High 33, Critical 22026-10-29 20:00 UTC: Medium 463, High 22, Critical 12026-10-29 21:00 UTC: Medium 462, High 25, Critical 22026-10-29 22:00 UTC: Medium 542, High 32, Critical 22026-10-29 23:00 UTC: Medium 436, High 27, Critical 52026-10-30 00:00 UTC: Medium 342, High 23, Critical 12026-10-30 01:00 UTC: Medium 699, High 25, Critical 22026-10-30 02:00 UTC: Medium 320, High 14, Critical 12026-10-30 03:00 UTC: Medium 379, High 28, Critical 12026-10-30 04:00 UTC: Medium 356, High 25, Critical 12026-10-30 05:00 UTC: Medium 217, High 23, Critical 12026-10-30 06:00 UTC: Medium 264, High 19, Critical 02026-10-30 07:00 UTC: Medium 261, High 25, Critical 22026-10-30 08:00 UTC: Medium 84, High 15, Critical 0
09:00 UTCMediumHighCritical08:00 UTC

Flagged domains per day.

UTC days.

2026-10-14: Medium 1,156, High 113, Critical 162026-10-15: Medium 4,256, High 579, Critical 432026-10-16: Medium 8,286, High 709, Critical 492026-10-17: Medium 4,883, High 706, Critical 292026-10-18: Medium 7,388, High 468, Critical 252026-10-19: Medium 4,780, High 615, Critical 532026-10-20: Medium 7,554, High 1,197, Critical 572026-10-21: Medium 7,604, High 901, Critical 542026-10-22: Medium 8,927, High 912, Critical 832026-10-23: Medium 18,652, High 908, Critical 542026-10-24: Medium 15,194, High 727, Critical 352026-10-25: Medium 15,029, High 704, Critical 252026-10-26: Medium 6,520, High 652, Critical 472026-10-27: Medium 12,063, High 656, Critical 512026-10-28: Medium 11,934, High 842, Critical 842026-10-29: Medium 11,045, High 845, Critical 692026-10-30: Medium 2,918, High 195, Critical 9
10-14MediumHighCritical10-30
Takedowns

826 flagged domains were later taken down.

We check high and critical domains again 24 and 72 hours after flagging them, and count those their registry or registrar has suspended or deleted.

  1. Held by the registrar411
  2. Held by the registry292
  3. Deleted123