Highscore 42 · flagged Friday, October 16, 2026

premvault.online

Appeared in the .online zone on Friday, October 16, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

page impersonates a brand
matched: Netflix
+22
brand in page title, not in the name
matched: netflix
+20
Registrar
Regional Network Information Center, JSC dba RU-CENTER
Nameserver provider
Nameservers
ns1.spaceweb.ru, ns2.spaceweb.ru, ns3.spaceweb.pro, ns4.spaceweb.pro
First-day state
active website
HTTP status
200
Page title
PREMVAULT — Премиум-доступ мгновенно
Has a form
no
Brand echoed
—

Model opinions

Second opinionsuspiciousconfidence 55%· claude-opus-5-5

The page is a self-branded Russian 'PREMVAULT' storefront reselling Netflix, Discord Nitro, ChatGPT Plus, YouTube Premium and Game Pass access at cut prices, paid by SBP, card or crypto, with support via Discord. It has no login form and does not pose as Netflix, so it is not phishing, but a day-old grey-market account-resale shop with self-claimed 4.8/5 ratings could equally be a fake shop or a reseller of unauthorized or stolen accounts.

First passlooks like a scamconfidence 95%· claude-haiku-4-5

This is a reseller/account-sharing marketplace selling unauthorized access to premium services (Netflix, Discord Nitro, ChatGPT Plus, YouTube Premium, etc.) at below-market prices. While it displays brand logos, it is not impersonating any specific organisation—it is transparently operating as an intermediary shop with its own "PREMVAULT" branding. The model is a known scam: selling compromised or shared credentials violates the terms of service of every listed brand and constitutes fraud agains

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Friday, October 16, 2026

Screenshot of premvault.online taken by the zone census on 2026-10-16

Same data as JSON: /api/zone/domain/premvault.online. This page is not indexed by search engines and does not link to the site it describes.