shopnova.co campaign · 1 server · 5 findings
One confirmed site (shopnova.co) led to 1 server hosting 4 ShopNova look-alikes — the same operator.
Infrastructure graph · drag nodes · solid = included, dashed = excluded by triage ⚙ budgeted pivot · ≤2 hops · ≤100 nodes
Dashed nodes were excluded by triage (reverse-IP noise, or the brand's own / whitelisted sites shown only for context). Edges: passive_dns · cert · favicon · tracking_id · reverse_whois
Actor profile · what ties the operation together
| Registrant | kitops@proton.example |
|---|---|
| Servers | 203.0.113.66 |
| Certificates | aaaaaaaaaaaaaaaa… |
| Tracking ids | UA-424242-1 |
| Investigated | 2026-10-14 09:51:03 |
Export · indicators your firewall or SIEM can block
Domains, IPs, certificate hashes and tracking IDs, each with first_seen and the evidence row it came from. STIX 2.1 imports directly into MISP, OpenCTI or Splunk ES. Mapped indicators also feed the Infrastructure signals of later scans.
Findings in this map
Co-hosted triage · every node and why it is in or out
Triage keeps a neighbour only if it shares a link signal (certificate, favicon, tracking ID, registrant) or looks like the brand; everything else on a shared server is reverse-IP noise. The brand's own and whitelisted sites are shown for context only.
| Node | Type | Decision | Reason | Attributes |
|---|---|---|---|---|
| aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa | certificate | included | seed certificate | |
| bakery-menu.example | domain | excluded | co-hosted neighbour without link signals (reverse-IP noise); AI triage skipped (unreachable) | |
| cheap-vps-customer7.example | domain | excluded | co-hosted neighbour without link signals (reverse-IP noise); AI triage skipped (unreachable) | |
| nordbank-verify.com | domain | excluded | analyst dismissed this host earlier | |
| secure-shopnova.com critical | domain | included | already a critical finding for this brand | |
| shopn0va.com critical | domain | included | already a critical finding for this brand | |
| shopnova-login.com critical | domain | included | already a critical finding for this brand | |
| shopnova.co critical | domain | included | seed finding | |
| 203.0.113.66 | ip | included | resolved by the seed | org: Mock Hosting LLC asn: 64531 ports: 80, 443 |
| kitops@proton.example | registrant | included | seed registrant | |
| UA-424242-1 | tracking_id | included | tracking id in seed page |