Skip to workspace
Sentinely

Operations

OverviewMentionsCases9OfficerMonitoring termsFeedsAnalyticsIntegrationsAPI & MCPSettings
Monthly volume1,284 / 5,000
System live
Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Exit demoStart your workspace

Signal workspace

Unofficial wallet app requests SMS and contact permissions.

Listing copies the product screenshots under an unrelated publisher and asks for interception-grade permissions.

Case queue
Vantablue StudioGoogle PlayFake appconfirmed

Observed content

Kestrel Pay Wallet Pro. Faster balance checks, instant transfers, and a live spending view the official app does not offer yet. Requires SMS, contacts, and accessibility access so the wallet can sync your account automatically and confirm transfers without extra steps.
2,140 installs31 reviewsrated 4.6Open source

Classifier assessment

Publisher is not Kestrel Financial Ltd, store imagery is copied from the official listing, and the requested permissions would expose one-time passcodes.

91

severity

Relevance
96%
First seen
38 min ago
Classifier
sentinel-threat-v1

Harm signals

credential-requestsensitive-permissionsunofficial-publisher

Evidence

Each capture is hashed on write. The digest is what makes the record checkable later.

4 retained
  • Listing metadataapify-listing12 KB · 12 Mar 2026, 13:43 UTC

    sha256bed072b660607decf482c06c564e5380adc8fcb8623a29cd56434713faf7d633

  • Screenshotcrawl4ai-screenshot491 KB · 12 Mar 2026, 13:44 UTC

    sha256fdb3403f7fcd1a0fb8377cecd7c78d88497034e20ea5984f893197ccfcdadf1f

  • Screenshotcrawl4ai-screenshot336 KB · 12 Mar 2026, 13:46 UTC

    sha2568538d2f9b9edf36fcc48697ee670ad984859054e4c1337a32e4b3a475c325774

  • Vision analysisvision-analysis4 KB · 12 Mar 2026, 13:47 UTC

    sha25649b414f194bd48329db5f149d76a04bc1421bd321d2dc3738a2ae379eac1303b

Dossier

sentinel-dossier-v1

pending

Executive summary

A Google Play listing published by Vantablue Studio reproduces the Kestrel Pay store imagery and product name under a publisher with no relationship to Kestrel Financial Ltd. The listing requests SMS, contacts, and accessibility permissions, which together would allow an installed build to read one-time passcodes. The listing has about 2,140 installs.

Evidence cited

  • Store listing metadata captured 12 Mar 2026, publisher recorded as Vantablue Studio.
  • Full store page screenshot showing product imagery matched to the official reference asset set.
  • Permission sheet screenshot recording the SMS, contacts, and accessibility requests.
  • Vision analysis returning a logo match against the registered wordmark, with the similarity caveat retained.

Reporting route

Google Play impersonation and intellectual-property form, filed by the brand owner of record. A human should confirm the current form and the publisher identity before submission.

Recommended action

File the platform report with the four retained captures attached, and notify support so inbound queries about the unofficial build can be answered consistently.

Sentinely provides evidence and recommendations only. The recipient decides and executes any report, enforcement, or legal action.

Actions

Officer approval is required to escalate. Sentinely documents and recommends. It does not execute takedowns or make legal determinations.

Tags

lookalike listingotp interception

Decision trail

Append-only. Every status change records who and why.

  1. detectedStore listing matched the reference asset set at 0.96.Collector · System · 38 min
  2. detected→documentedListing metadata, store page, and permission sheet captured.Priya Raghunathan · Analyst · 32 min
  3. documented→confirmedPublisher has no relationship to Kestrel Financial Ltd, and the SMS plus accessibility permissions together would expose one-time passcodes on an installed build.Priya Raghunathan · Analyst · 26 min