YooMoney's YuScan Automates E-commerce Risk Assessment Scanning Up to 1,000 Sites Per Hour
YooMoney has published a detailed technical overview of YuScan, its internal service for automated risk assessment of e-commerce websites. The tool helps banks and payment organizations detect merchants that attempt to mask prohibited or high-risk activities behind seemingly legitimate storefronts.
Since its launch in 2020, YuScan has analyzed more than 550,000 merchant applications. During this period YooKassa has not received any regulatory fines related to servicing prohibited business activities.
The service is intended for organizations that process over 10,000 pages daily, work with acquiring, marketplaces, KYC/AML checks, or must comply with Russian Federal Law 152-FZ. Manual analysis of such volumes quickly becomes a bottleneck, so YuScan was developed to perform deep, automated audits at scale.
From URL to Report in Minutes
YuScan starts from a merchant’s homepage and recursively crawls the entire site structure. It behaves like a real browser by executing JavaScript, waiting for dynamic elements, and scrolling through pages. This approach reveals content that would remain hidden under simple HTTP requests.
Asynchronous processing allows the system to handle up to 1,000 sites per hour. For modern sites that rely heavily on JavaScript, the crawler uses the Playwright library. When standard automation is blocked by advanced anti-bot systems such as Cloudflare, YuScan switches to Camoufox, which modifies browser behavior at the C/C++ level to produce cleaner fingerprints and avoid detection.
Technology Stack and Architecture
The service is written in Python. The API layer is built with FastAPI, data is stored in PostgreSQL, and the crawling core is based on the open-source Scrapy framework. Playwright handles browser automation while custom scaling and risk-scoring logic sit on top of Scrapy’s queue and pipeline system.
After data collection, multiple analysis stages begin. Text, images, reviews, external links, and registration details are examined. Images are converted into vector embeddings and compared against sensitive categories such as alcohol, tobacco, and online gambling. Large language models evaluate context to reduce false positives.
External Signals and Final Scoring
YuScan also checks whether a domain appears in Roskomnadzor registries, reviews third-party feedback, analyzes WHOIS records, and looks for signs of cloned or fraudulent sites. Extracted company details (INN, KPP, OGRN, contacts, and legal documents) help distinguish real businesses from temporary or opaque operations.
Since the introduction of automated checks, merchant onboarding times have improved significantly: simple cases are completed in under three hours, half of all companies begin processing payments within one day, and seven out of ten finish the process within two days.
Related articles
Scammers Impersonate Social Fund to Threaten Child Benefit Cancellation and Steal Savings
Fraudsters have launched a new social engineering campaign targeting parents by impersonating officials from Russia's Social Fund. Callers claim that suspicious transfers have been detected on family accounts and threaten the cancellation of child benefits unless savings are moved to a special transit account. The scheme relies on fabricated rules about income assessment and uses the promise of an 'unreported' account to trick victims into sending money. The Narodny Front's Moshelovka platform, cited by RIA Novosti, confirms that the Social Fund never requests transfers to third-party accounts for benefit verification. Families are instructed to check official notifications exclusively through Gosuslugi or by visiting an SFR office in person. Authentication codes from government services or banking apps must never be shared over the phone.
Silent Call Answering on Android: Defeating Phone Spam by Removing Human Attention
A detailed proposal suggests abandoning traditional spam call blocking in favor of allowing all incoming calls to connect automatically while keeping them invisible to the user. The approach uses Android's Telecom Framework and InCallService to answer calls silently without ringing, notifications, or screen activation. This breaks the economic model of mass dialing systems by inflating answered call metrics with empty connections that contain no human. The concept separates the technical establishment of a call from delivering user attention, forcing spammers to detect real people after the connection is made. Implementation requires the app to hold the ROLE_DIALER role and selectively invoke Call.answer() based on custom rules instead of always showing the incoming call UI. The author argues this shifts the detection burden onto robocall platforms and reduces the value of every successful connection.
Telegram Scam Bot Exposed by Fixed Timer and Deleted Messages in Telethon Userbot Analysis
A detailed investigation into a romance scam attempt on Telegram revealed an AI-driven userbot masquerading as a woman named Maria from Yaroslavl. The bot maintained consistent 4-5 minute response delays regardless of message length or time of day, responded to deleted messages, and accumulated multiple inputs before replying in batches. It refused out-of-character requests using repetitive phrases like "I am not a..." and handed off media or confusing inputs to a human operator. The bot failed to react to a nonexistent city name and ignored voice messages containing silence, leading to delayed human intervention. The chat was later deleted from the scammer side after testing, and the account ignored messages from a second profile. The analysis includes a full reconstruction of the bot's logic using the Telethon library, highlighting prompt protections against jailbreaks and reliance on fixed delays.
CACTER Upgrades PhishSim Anti-Phishing Simulation System to Reduce Employee Click Rates
CACTER has released an updated version of its PhishSim anti-phishing training platform that allows organizations to run realistic simulated attacks in just four steps. The system replicates common phishing vectors including malicious links, infected attachments, and disguised QR codes while spoofing sender addresses and official domains. Organizations can draw from a continuously refreshed template library covering invoices, financial subsidies, system notifications, and industry-specific scenarios. After each campaign the platform produces detailed visual reports that rank departments, classify employee risk levels, and recommend concrete remediation steps. Long-term use of the platform has been shown to lower average click rates from 23.88 percent to 4.16 percent. The solution is designed for immediate deployment without requiring dedicated security staff.