YooMoney's YuScan Automates E-commerce Risk Assessment Scanning Up to 1,000 Sites Per Hour
YooMoney has published a detailed technical overview of YuScan, its internal service for automated risk assessment of e-commerce websites. The tool helps banks and payment organizations detect merchants that attempt to mask prohibited or high-risk activities behind seemingly legitimate storefronts.
Since its launch in 2020, YuScan has analyzed more than 550,000 merchant applications. During this period YooKassa has not received any regulatory fines related to servicing prohibited business activities.
The service is intended for organizations that process over 10,000 pages daily, work with acquiring, marketplaces, KYC/AML checks, or must comply with Russian Federal Law 152-FZ. Manual analysis of such volumes quickly becomes a bottleneck, so YuScan was developed to perform deep, automated audits at scale.
From URL to Report in Minutes
YuScan starts from a merchant’s homepage and recursively crawls the entire site structure. It behaves like a real browser by executing JavaScript, waiting for dynamic elements, and scrolling through pages. This approach reveals content that would remain hidden under simple HTTP requests.
Asynchronous processing allows the system to handle up to 1,000 sites per hour. For modern sites that rely heavily on JavaScript, the crawler uses the Playwright library. When standard automation is blocked by advanced anti-bot systems such as Cloudflare, YuScan switches to Camoufox, which modifies browser behavior at the C/C++ level to produce cleaner fingerprints and avoid detection.
Technology Stack and Architecture
The service is written in Python. The API layer is built with FastAPI, data is stored in PostgreSQL, and the crawling core is based on the open-source Scrapy framework. Playwright handles browser automation while custom scaling and risk-scoring logic sit on top of Scrapy’s queue and pipeline system.
After data collection, multiple analysis stages begin. Text, images, reviews, external links, and registration details are examined. Images are converted into vector embeddings and compared against sensitive categories such as alcohol, tobacco, and online gambling. Large language models evaluate context to reduce false positives.
External Signals and Final Scoring
YuScan also checks whether a domain appears in Roskomnadzor registries, reviews third-party feedback, analyzes WHOIS records, and looks for signs of cloned or fraudulent sites. Extracted company details (INN, KPP, OGRN, contacts, and legal documents) help distinguish real businesses from temporary or opaque operations.
Since the introduction of automated checks, merchant onboarding times have improved significantly: simple cases are completed in under three hours, half of all companies begin processing payments within one day, and seven out of ten finish the process within two days.
Related articles
Scammers Pose as Employers to Remotely Lock iPhones and Demand Ransom
Russian police have warned of a new social engineering scheme in which fraudsters impersonate potential employers to gain control of victims' Apple devices. The attackers instruct targets to sign out of their personal Apple accounts and authenticate using credentials supplied by the supposed employer. Once the device links to the fraudster's account, the scammers can remotely lock the iPhone or iPad and demand payment for unlocking it. Authorities emphasize that paying the ransom does not guarantee recovery of the device and may lead to further extortion demands. Victims are advised never to enter third-party Apple credentials on personal hardware and to contact Apple Support with proof of purchase if a device is already locked. The scheme exploits the Find My and Activation Lock features built into iOS devices.
Scammers Target Remote Workers with Fake Compensation for Home Internet and Devices
Russian remote employees are being targeted by fraudsters impersonating employers, government agencies, and corporate IT departments. Attackers lure victims with promises of compensation for home internet costs and personal computers, directing them to fake sites for identity verification or SMS code submission. Instead of receiving payments, victims risk handing over account credentials or banking details to criminals. Another tactic involves urgent messages from supposed IT services demanding immediate access renewal or software updates via malicious links. The pressure of urgency aims to bypass caution, leading users to click links, enter passwords, or execute files before verifying the sender. Home networks present additional risks because users manage their own routers and connected devices, unlike secured office environments. Experts from Yandex recommend changing default router passwords, updating firmware, disabling quick device pairing, and isolating smart devices on a separate guest network.
Phishing Reports Fall 42.6% in June While Abused URLs Rise 3.2%
The Phishing Countermeasures Council recorded 72,370 phishing reports in June 2026, a 42.6% drop from 126,061 reports the previous month. Despite the decline in reports, the number of malicious URLs increased to 42,241, up 3.2% from the prior month. More than 90% of the phishing emails received by the council's monitoring addresses used unique domains. The largest share of attacks targeted the EC sector at 42.7%, followed by credit and finance services at 27.4%. The council noted that this marks the second consecutive month of declining reports after a peak in April.
WhatsApp Begins Limited Beta Testing of On-Device Scam Alert to Detect Fraud While Preserving End-to-End Encryption
WhatsApp has started limited beta testing of its Scam Alert feature, which uses an on-device machine learning model to analyze message patterns and linguistic indicators of fraud. The system runs entirely locally on the user's smartphone, ensuring that conversation content is never sent to WhatsApp or Meta. Users receive warnings about suspicious messages from unknown contacts and can choose to block, report, ignore, or mark the chat as trusted. To maintain transparency, each model release is logged in an immutable journal managed by Cloudflare with Ed25519 signatures and SHA-256 hashes. The company receives only anonymized statistics on detections and user actions. In parallel, Signal has introduced automatic key verification using a cryptographically verifiable log audited by Cloudflare and Trail of Bits.