TALE-VAULT: 3,622 domains, 42 samples and the technical architecture of lead capture

Introduction

Investment offers can change brand without changing technology. A different commercial presentation can rely on the same templates, forms and tracking services. That separation between visible identity and implementation makes it possible to reuse the infrastructure and requires investigating the complete path, in addition to the name of each page.

Vaca Muerta Investment offers a recognizable entry point for Argentine readers. The capture preserved on September 11, 2026 shows a page in German, a promise of earnings above €950 a day through trading and a form with the telephone prefix +49. The name evokes Argentina; the recorded content is configured for Germany. The page does not establish a relationship with an energy project.

Following that lead, I identified a much larger structure: 3,003 registrable entry domains associated with 619 destination domains in 5,291 public records. The union of both layers brings together 3,622 distinct domains. The 42 preserved pages make it possible to examine in detail the code and content of part of that set of records.

The investigation connects the scale of the set with how it works: destinations that change, templates that reappear under other brands and services that measure the visitor's interest. Four sessions also make it possible to demonstrate a path from entries hosted at OmegaTech to pages that contact TALE. This report brings those relationships together under TALE-VAULT, the working name for the technical set, without attributing an actor identity to it.

Tap the image to enlarge it

Tap the image to enlarge it

Key findings

• 3,622 domains in two layers. The set of records contains 3,003 entries and 619 destinations, with no overlap between the two sets. The 5,291 records reduce to 5,247 distinct entry-destination pairs: there is reuse and repeated observations, not 5,291 independent platforms.
• The relationship between brand and destination changes. A total of 1,711 entries appear with more than one destination and 955 cross different name prefixes. In the visual sample, the same brand also changes template and narrative.
• The implementation keeps stable components. The 42 preserved records share the hash of loader.js; the 42 HTML files include the same campaignCode and analytics host. The sample brings together 26 template identifiers and 15 configuration countries.
• OmegaTech is connected by four concrete paths. The evidence preserves the response of each entry, the script that starts the page change and a subsequent request from the destination to the TALE service. The connection corresponds to the hosting of the entries.
• Lead capture is instrumented. The code prepares forms, telephone verification, continuation after registration and a behavior associated with the Back button. Historical traffic confirms visit measurement; the subsequent delivery of contacts and the payment circuit have still not been reconstructed.

Who may find this useful

• Intelligence and fraud analysts: relate brands by their artifacts and reconstruct destination changes.
• SOC and response teams: investigate historical access, distinguish a visit from data delivery and prioritize stable signals.
• Hosting, CDN and brand protection providers: receive reports with delimited resources, dates and paths.
• End users: recognize that a professional page, a familiar brand or SMS verification do not establish an authorized investment.

What each quantity means

The main window runs from September 6 at 18:30:26 UTC to October 6 at 17:16:28 UTC, 2026. The counts describe that selected file, not the full size of an operation or a number of victims.

Destination rotation

The separation between a commercial entry and its destination is the first structural feature of the set. Different names lead into a smaller layer of publication domains. In turn, the same entry appears associated with different destinations over the course of the observations.

The set of records contains 1,711 entries linked to more than one destination, approximately 57 % of the 3,003 entries. In 955 cases, the destinations belong to different prefixes. Those changes make it possible to follow the continuity of an entry even when its final page is no longer the same.

The names follow the sequence fisios → finme → finnio → fizzy → filzzy → finzzy → new → newwy. In the file, their windows appear one after another. This documents rotation of destination names; it does not demonstrate that each prefix is a software version, a different client or a coordinated migration order.

Nor do we know the full lifespan of each domain. A destination observed for minutes may have existed before or after the available captures. The cadence of the file is not equivalent to the actual cadence of the entire infrastructure.

Thousands of URLs do not equal thousands of designs

The 5,291 final URLs are distinct, but they incorporate variable parameters. The URL count describes paths and observations; it does not demonstrate 5,291 different templates. The sample of 42 HTML files contains 26 landingId values, while a single template appears in nine brands. The scale must be communicated while preserving those units.

Relationships between entries and destinations

The tables and annexes bring together the scale of the records, the application sample and the four OmegaTech chains. They distinguish associations between entry and destination, audited navigations and capabilities visible only in the code.

The downloadable annexes preserve the 3,622 domains and the 5,247 distinct relationships between entry and destination. Each relationship includes the public identifiers that support it. Those edges express the coincidence of entry and final destination within the same result: they do not attribute a JavaScript initiator to all records or common control over their domains.

The downloadable inventory and relationship table make it possible to search entries and destinations and consult the observations that support each relationship.

The lead-capture path

Stage 1 Present the opportunity

The apparent objective is to turn attention into willingness to register. Vaca Muerta Investment combines a recognizable name with promises of earnings, ratings, availability and a form. The presentation seeks to provide familiarity and urgency. The origin of the visits —ads, social networks, email or messages— was not established.

Stage 2 Lead to a destination page

The commercial entry and the final page are decoupled. The set of records preserves their association and the four OmegaTech chains make it possible to verify the change through a script on the entry itself. This architecture can keep the name the user sees while replacing the page that carries out the lead capture.

Stage 3 Adapt the presentation

The HTML files contain brand, country, template and campaign configuration. The same base can display different commercial identities and local versions. It works like a production line for presentations: pieces are reused and the visible elements change. The evidence does not support stating that the kit is sold as a service.

Stage 4 Prepare the contact and check the telephone

The code collects first name, last name, email and telephone. It provides for requesting and checking a telephone code and sending the form to /send-v2. These functions could validate that the contact is reachable and prepare its continuation. No forms were submitted and no registration responses were checked; the verification does not demonstrate theft of banking codes.

Stage 5 Measure interest during the visit

Measurement runs in parallel to the presentation and registration. The archived requests to TALE include visit identifier, page type, active time and reading progress. The code also integrates PostHog. This instrumentation makes it possible to associate behavior with a visit, as in a sales funnel.

Stage 6 Prepare the continuation

The code accepts a continuation address if registration succeeds. The pages remind users to answer a call from a supposed account manager; Bitpie Wallet presents a first deposit as part of getting started. Those references show the path proposed to the user. No calls, effective delivery to an intermediary or payments made were observed.

Tap the image to enlarge it

The implementation behind the pages

One template with nine identities

Vaca Muerta Investment shares landingId 1741, country de and campaignCode WnFHimVys-nV with eight other brands. The configuration match accompanies the visual resemblance and makes it possible to relate their presentations more precisely than a comparison of logos.

The names are recorded as they appear on the pages. Their presence does not establish authorization or participation by companies with similar names. The dates are preserved observations, not dates of creation or replacement of the brands.

One brand with several presentations

The relationship also works in reverse. DonTradeZip keeps landingId 2339, 1677 and 1502 in three records from September 28 and October 2 and 3. BAYKAR shows 1749, 2080 and 2690; Bright Stakeldom, 2080 and 1671. Therefore, the entry name does not identify a fixed template.

These changes explain why an isolated capture may represent only one version of the offer. The file does not make it possible to isolate the cause: an update, distribution of visits, localization or another decision. A cloaking technique has not been demonstrated.

Content localization

The 42 HTML files contain 15 configuration countries: Germany, Australia, Canada, Switzerland, Austria, the Netherlands, Israel, Japan, the United Kingdom, Italy, Finland, Poland, Spain, France and Denmark. None corresponds to Latin America. They are selections made by the application; they do not identify a victim's country or the operator's location.

Shared code and visit tracking

The loader as a fingerprint of continuity

The same SHA-256 of loader.js appears in the 42 preserved records. The HTML files include a constant campaignCode and the same PostHog host. Taken together, these matches support continuity of components within the sample. They do not make it possible to choose between a central operator, several clients of a platform or several people reusing the same implementation.

Parameters that accompany the entry

The final URLs in the set of records incorporate on and d. The first carries a label related to the name presented; the second contains an opaque value that changes with each observation. Their presence offers material for reconstructing the path, but we have not established what d represents or demonstrated that its content is encrypted.

Form and telemetry have different functional destinations

The Vaca Muerta HTML prepares the form submission to /send-v2 and contains functions at /verification/request and /verification/check. They are routes relative to the page. The TALE service, for its part, receives interaction metrics through /engagement/ping. That measurement endpoint must not be described as a demonstrated recipient of the form's personal data.

The PostHog configuration points to a specific host and the code provides for session recording. The records preserve requests and responses for resources from that host; that does not by itself establish analytics events sent or recordings made. No recordings or administrative panel were recovered. PostHog and the interface libraries are legitimate tools and their use does not imply participation by their providers.

A behavior planned for the Back button

The preserved code includes a popstate handler that builds an address toward qooqlle[.]com with language, brand and visit identifier parameters. It is a function intended to act when the browser history changes. It was not executed during this review and the content of the destination was not observed, so its final function remains pending.

Where the reconstruction ends

The code mentions events such as lead_created, lead_sent and deposit. They are tracking labels; they do not establish contacts delivered or deposits made. The evidence does not include a CRM, the response to a completed registration, a call center or recipients of funds. The reconstruction reaches as far as the prepared lead capture and the observed measurement.

In the 42 preserved sessions no requests were found to /send-v2, /verification/request or /verification/check. The presence of these routes in the code establishes available capability, not a completed registration.

Verified providers and infrastructure

The review distinguishes two providers with verified functions in this case file. Cloudflare appears at the edge of the destinations and of the services reviewed. OmegaTech appears as the host of four entries. They are different functions within the path and not an attribution of control over the offers.

In all four cases, the browser ended up on a different page and recorded POST HTTP 200 to api.tale-tro-ve-vault[.]com/engagement/ping. The entry IP, the ASN and the initiator of the change are preserved within each session. This is more specific evidence than a hosting match.

The origin of the 619 destinations behind the Cloudflare edge was not identified. The 503 IPs are not equivalent to 503 dedicated servers or VPSs. Vaca Muerta is related to the set by its template and components; its own capture does not establish an entry from OmegaTech. No connections with Sutarevon or other case files based only on names or providers were added.

Assessment and conclusion

Reading scale and code together reveals a reusable architecture: thousands of entries are associated with a smaller layer of destinations, brands and templates change their relationships, and several services remain stable in the sample. The structure makes it possible to sustain multiple presentations without each visible name requiring an independent implementation.

The files support the recalculated counts and the four recorded sequences, within their source files. The reuse of the implementation is a conclusion supported by the code sample. The identity, number and organization of those who use it remain undetermined.

Vaca Muerta shows how a recognizable name can be integrated into an offer localized for another market. The scope of that observation is precise: German content, euros and the prefix +49 in a historical capture. It does not demonstrate Argentine or German victims, or an operation aimed at Latin America.

The case makes it possible to observe mechanisms associated with the industrialization of lead capture: separation of functions, reuse of components, brand adaptation and behavior measurement. Neither a commercialization of the kit as SaaS nor a concrete criminal hierarchy has been demonstrated. The useful result is a technical structure that can be investigated and detected through relationships, in addition to individual domains.

Recommendations for organizations

• Search DNS, proxy and navigation logs for the entries, destinations and measurement hosts in the case file. A historical match requires context: exposure, form submission and compromise of a device are different situations.
• Correlate the complete path. Keep entry address, final destination, date, HTML and requests; a block limited to one brand may lose continuity when its destination changes.
• Prioritize combinations of fingerprints: loader, configuration, TALE endpoint and PostHog host. Route names and generic libraries are not enough on their own.
• If data was delivered, review subsequent contacts and possible payment instructions. Preserve messages and receipts before they disappear.
• For providers, process reports with domains, historical IPs, dates and the four session records. Avoid extending a classification to an entire ASN, a CDN or legitimate domains by association.

For end users

• Check the entity and its investment authorization through independent channels before completing a form. A familiar name or a verification SMS does not establish legitimacy.
• If you have already left your details, keep the page and the messages from the supposed account manager. If a payment was made, contact the bank or payment provider as soon as possible with the receipts.

Method and sources of the case file

The sets were recalculated from corpus_a_scans.csv, preserved in the original dossier. Each row is a public URLScan result selected through a query by the host of the TALE API. That all rows are related to that host is part of the selection criterion; it does not constitute an independent measurement of prevalence.

42 paired PNG, 42 HTML and 42 JSON files were reviewed, with observations from September 7 to October 6. The inspection of the four chains was carried out on the entry responses, the frame, the navigation initiator and the subsequent requests to TALE. The images and records of the same session are complementary evidence, not independent sources.

This review used preserved material. The pages investigated were not visited, their scripts were not run and no forms were submitted. Current availability was not checked. The analysis and writing were carried out with AI assistance based on the researcher's files.

Public primary records

S1 Vaca Muerta Investment | September 11, 2026

S2 KronexKraftTrade | September 10, 2026

S3 ProfinaFundecor | September 25, 2026

S4 Bitpie Wallet | October 4, 2026

S5 Iberdrola Trade | October 5, 2026

The file nueve_marcas.csv links the nine captures of template 1741. relaciones_entrada_destino.csv preserves the 5,247 relationships with their scan_id. metricas_verificadas.json identifies the original ZIP and the SHA-256 of the CSV used. The relationship table makes it possible to reproduce the connections without depending on a summarized view.

Traceability of the counts

The prefixes were obtained from the actual name of each destination, and records, unique entries and unique destinations were counted separately. The set contains 618 .sbs domains and one .site domain. The 5,247 distinct relationships keep their source observations, so each connection can be checked against the source file. The four OmegaTech chains add a detailed navigation check without attributing control to the provider.

No other networks were added to the set of records for sharing a provider, prefix or file name. Unproven relationships remain outside the navigation graph. This separation preserves the value of the finding and makes it possible to expand it with new evidence without mixing case files.

Historical indicators and correlation elements

These indicators correspond to the observed period. Revalidate their status before applying current blocks. The names are presented defanged and the confidence refers to their relationship with this case file, not to an attribution of ownership.

Fingerprint of the shared file

SHA-256 of loader.js in the 42 preserved records:

0a59565c5d4f3234c826ec37adbb1af67f8581998bc4029c738a963e718d9048

Correlation of the nine-brand template: landingId 1741; country de; campaignCode WnFHimVys-nV. These values should be used together with other fingerprints, not as isolated proof of malicious activity.

The 3,622 domains and their relationships are available in the data annexes. Cloudflare edge IPs, legitimate libraries and generic JSON success responses are not proposed as individual blocking indicators.

The 42 complete samples and their configurations

Each row corresponds to a preserved set of HTML, JSON and capture. The dates are historical observations. The hashes of the three pieces are included in the samples annex.

Data, sources and hashes

The annexes preserve the defanged domains and the public observation identifiers. Cookies, session headers, opaque URL parameters and executable scripts from the pages investigated are excluded.

• 5,291 records with date and public source
• 5,247 relationships between entry and destination
• 3,622 domains by function
• 42 samples: configuration and SHA-256 of HTML, JSON and capture
• Nine brands with template 1741 and country de
• Chronology of the eight prefixes
• Verified count

SHA-256 of the original CSV: d63cd3292898707b5812e1d95fb5ba9ccd471497b7fea31dabdbc365765b5336. SHA-256 of the preserved package used: 79936790ec8b8b980795106419ca92ee4c0e35e679feefc45c53b344b5a43f64. The derived public CSVs have their own hashes and do not replace the original file.