Analysing again…leaving that link out and working out which sites are still connected
ALL CONFIRMED SITES · one map: are they connected, and by what?
✓
Analysis complete
· 26 sites · 4 operations · 16 unattributed · 1 social page
Every site was mapped and investigated. The ties below use all of it.
10 of 26 confirmed sites are tied together in 4 groups. The largest has 4 sites that share the same TLS certificate, the same analytics / pixel ID, the same registrant, the same server: secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co. 16 sites have no strong link to the others.
0
confirmed sites
0
connected groups
0
sites in a group
0
no strong link
0
strong links
0
hints & common
The map
Show:
Big dot with a name = a site you confirmed (colour = severity) · small dot with a letter = something several sites have in common · line = “has that”, thicker = a stronger tie. Each operation sits in its own coloured area. Point at a dot to light up what it touches, click it for details. Scroll to zoom, drag the background to move the map, drag a dot to move it (double-click it to let go).
affiliate id · registrant · DNS token
server
TLS certificate · page code
analytics ID · where the data goes
redirect host
traffic campaign
dashed = a hint, not proof on its own
Which sites are connected · one card per operation (a group of sites that belong to one attacker)
⚿
Phishing kit · 4 sites
Operation 1 · Phishing kit — collects passwords or card details
100
4sites
1brand
2026-10-04
→ 2026-10-10bought · in waves
→ 2026-10-10bought · in waves
4/4credential form
Because they share
registrantkitops@proton.example
90%
analytics idUA-424242-1
90%
certificateaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa...
80%
server203.0.113.66
80%
Each of the 4 domains collects passwords or card details. 4 of 4 domains were registered within 7 day(s) (2026-10-04 → 2026-10-10): a batch, not a coincidence. 4/4 credential form.
| Registrar | Mock Registrar LLC ×4 |
|---|---|
| Hosting | BulletproofHost BV (hoster) ×4 |
First step: One bulk abuse report to Mock Registrar LLC
Details
How to stop it 2
1. One bulk abuse report to Mock Registrar LLC
4 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co
2. Report the hosting provider BulletproofHost BV
The provider can disable the servers that host these pages.
secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co
Who is with whom 2 clusters
Sites that share exactly the same things are shown together, so many links with the same sites read as one line.
secure-shopnova.comshopn0va.comshopnova-login.comshopnova.co
4 sites share:
registrant kitops@proton.example 90%analytics id UA-424242-1 90%certificate aaaaaaaaaaaaaaaaaaa... 80%server 203.0.113.66 80%registered together Mock Registrar LLC... 30%page look screenshot be37c1cd4c 30%
shopn0va.comshopnova.co
2 sites share:
page code page a73787bf58 60%
Who against whom · how sure we are that two sites are one operation (hover a cell for what ties them)
secure-shopnova.com | shopn0va.com | shopnova-login.com | shopnova.co | |
|---|---|---|---|---|
| secure-shopnova.com | 100 | 100 | 100 | |
| shopn0va.com | 100 | 100 | 100 | |
| shopnova-login.com | 100 | 100 | 100 | |
| shopnova.co | 100 | 100 | 100 |
Who shares what 4 of the 4 sites are on one server
Same server (address) 1
| 203.0.113.66 BulletproofHost BV · hoster |
4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
TLS certificates 1
| aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa... | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
Analytics / pixel IDs 1
| UA-424242-1 | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
Registrants 1
| kitops@proton.example | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
Name servers 2
| ns1.mock-dns.example | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
| ns2.mock-dns.example | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
Registrars 1
| Mock Registrar LLC | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
Bought together 1
| Mock Registrar LLC · 2026-09-30 → 2026-10-11 | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
Same page code 1
| page a73787bf58 | 2 sites shopn0va.com, shopnova.co |
Pages that look the same 1
| screenshot be37c1cd4c | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
Favicons 1
| -2029202433 | 4 sites secure-shopnova.com, shopn0va.com, shopnova-login.com, shopnova.co |
Site by site 4
| site | registered | registrar | server(s) | hosting | name servers | ends on |
|---|---|---|---|---|---|---|
| secure-shopnova.com | 2026-10-10 | Mock Registrar LLC | 203.0.113.66 | BulletproofHost BV (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | secure-shopnova.com |
| shopn0va.com | 2026-10-09 | Mock Registrar LLC | 203.0.113.66 | BulletproofHost BV (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopn0va.com |
| shopnova-login.com | 2026-10-08 | Mock Registrar LLC | 203.0.113.66 | BulletproofHost BV (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnova-login.com |
| shopnova.co | 2026-10-04 | Mock Registrar LLC | 203.0.113.66 | BulletproofHost BV (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnova.co |
What ties them together 7
the same registrant90%
kitops@proton.example · 4 sites
kitops@proton.example · 4 sites
the same analytics / pixel ID90%
UA-424242-1 · 4 sites
UA-424242-1 · 4 sites
the same TLS certificate80%
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa · 4 sites
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa · 4 sites
the same server80%
203.0.113.66 · 4 sites · BulletproofHost BV
203.0.113.66 · 4 sites · BulletproofHost BV
the same page code60% · hint
page a73787bf58 · 2 sites
page a73787bf58 · 2 sites
registered together at one registrar30% · hint
Mock Registrar LLC · 2026-09-30 → 2026-10-11 · 4 sites
Mock Registrar LLC · 2026-09-30 → 2026-10-11 · 4 sites
a page that looks the same30% · hint
screenshot be37c1cd4c · 4 sites
screenshot be37c1cd4c · 4 sites
Also in common, but weak (they never group sites):
the same favicon
-2029202433
-2029202433
the same registrar
Mock Registrar LLC
Mock Registrar LLC
the same name server
ns1.mock-dns.example
ns1.mock-dns.example
the same name server
ns2.mock-dns.example
ns2.mock-dns.example
Evidence per site 4
| site | registrant | tracking id | certificate | ip | kit | batch | kit look |
|---|---|---|---|---|---|---|---|
| secure-shopnova.com | ● | ● | ● | ● | · | ● | ● |
| shopn0va.com | ● | ● | ● | ● | ● | ● | ● |
| shopnova-login.com | ● | ● | ● | ● | · | ● | ● |
| shopnova.co | ● | ● | ● | ● | ● | ● | ● |
⚿
Phishing kit · 2 sites
Operation 2 · Phishing kit — collects passwords or card details
80
2sites
1brand
2020-03-17
→ 2026-10-11bought
→ 2026-10-11bought
1/2credential form
Because they share
server203.0.113.107
80%
Each of the 2 domains collects passwords or card details. Registered over 2399 days (2020-03-17 → 2026-10-11). 1/2 credential form.
| Registrar | Mock Registrar LLC ×2 |
|---|---|
| Hosting | Mock Hosting LLC (hoster) ×2 |
First step: One bulk abuse report to Mock Registrar LLC
Details
How to stop it 2
1. One bulk abuse report to Mock Registrar LLC
2 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
shopnova-account.net, shopnova-press.com
2. Report the hosting provider Mock Hosting LLC
The provider can disable the servers that host these pages.
shopnova-account.net, shopnova-press.com
Who is with whom 1 cluster
Sites that share exactly the same things are shown together, so many links with the same sites read as one line.
shopnova-account.netshopnova-press.com
2 sites share:
server 203.0.113.107 80%
Who against whom · how sure we are that two sites are one operation (hover a cell for what ties them)
shopnova-account.net | shopnova-press.com | |
|---|---|---|
| shopnova-account.net | 80 | |
| shopnova-press.com | 80 |
Who shares what 2 of the 2 sites are on one server
Same server (address) 1
| 203.0.113.107 Mock Hosting LLC · hoster |
2 sites shopnova-account.net, shopnova-press.com |
Name servers 2
| ns1.mock-dns.example | 2 sites shopnova-account.net, shopnova-press.com |
| ns2.mock-dns.example | 2 sites shopnova-account.net, shopnova-press.com |
Registrars 1
| Mock Registrar LLC | 2 sites shopnova-account.net, shopnova-press.com |
Site by site 2
| site | registered | registrar | server(s) | hosting | name servers | ends on |
|---|---|---|---|---|---|---|
| shopnova-account.net | 2026-10-11 | Mock Registrar LLC | 203.0.113.107 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnova-account.net |
| shopnova-press.com | 2020-03-17 | Mock Registrar LLC | 203.0.113.107 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnova-press.com |
What ties them together 1
the same server80%
203.0.113.107 · 2 sites · Mock Hosting LLC
203.0.113.107 · 2 sites · Mock Hosting LLC
Also in common, but weak (they never group sites):
the same registrar
Mock Registrar LLC
Mock Registrar LLC
the same name server
ns1.mock-dns.example
ns1.mock-dns.example
the same name server
ns2.mock-dns.example
ns2.mock-dns.example
Evidence per site 2
| site | ip |
|---|---|
| shopnova-account.net | ● |
| shopnova-press.com | ● |
⚿
Phishing kit · 2 sites
Operation 3 · Phishing kit — collects passwords or card details
92
2sites
1brand
2026-09-17
→ 2026-10-06bought
→ 2026-10-06bought
2/2credential form
Because they share
server203.0.113.133
80%
page codepage 6004976ec5
60%
Each of the 2 domains collects passwords or card details. Registered over 19 days (2026-09-17 → 2026-10-06). 2/2 credential form.
| Registrar | Mock Registrar LLC ×2 |
|---|---|
| Hosting | Mock Hosting LLC (hoster) ×2 |
First step: One bulk abuse report to Mock Registrar LLC
Details
How to stop it 2
1. One bulk abuse report to Mock Registrar LLC
2 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
shopnova-support-center.com, shopnova-verification.com
2. Report the hosting provider Mock Hosting LLC
The provider can disable the servers that host these pages.
shopnova-support-center.com, shopnova-verification.com
Who is with whom 1 cluster
Sites that share exactly the same things are shown together, so many links with the same sites read as one line.
shopnova-support-center.comshopnova-verification.com
2 sites share:
server 203.0.113.133 80%page code page 6004976ec5 60%
Who against whom · how sure we are that two sites are one operation (hover a cell for what ties them)
shopnova-support-center.com | shopnova-verification.com | |
|---|---|---|
| shopnova-support-center.com | 92 | |
| shopnova-verification.com | 92 |
Who shares what 2 of the 2 sites are on one server
Same server (address) 1
| 203.0.113.133 Mock Hosting LLC · hoster |
2 sites shopnova-support-center.com, shopnova-verification.com |
Name servers 2
| ns1.mock-dns.example | 2 sites shopnova-support-center.com, shopnova-verification.com |
| ns2.mock-dns.example | 2 sites shopnova-support-center.com, shopnova-verification.com |
Registrars 1
| Mock Registrar LLC | 2 sites shopnova-support-center.com, shopnova-verification.com |
Same page code 1
| page 6004976ec5 | 2 sites shopnova-support-center.com, shopnova-verification.com |
Favicons 1
| -2029202433 | 2 sites shopnova-support-center.com, shopnova-verification.com |
Site by site 2
| site | registered | registrar | server(s) | hosting | name servers | ends on |
|---|---|---|---|---|---|---|
| shopnova-support-center.com | 2026-09-17 | Mock Registrar LLC | 203.0.113.133 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnova-support-center.com |
| shopnova-verification.com | 2026-10-06 | Mock Registrar LLC | 203.0.113.133 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnova-verification.com |
What ties them together 2
the same server80%
203.0.113.133 · 2 sites · Mock Hosting LLC
203.0.113.133 · 2 sites · Mock Hosting LLC
the same page code60% · hint
page 6004976ec5 · 2 sites
page 6004976ec5 · 2 sites
Also in common, but weak (they never group sites):
the same favicon
-2029202433
-2029202433
the same registrar
Mock Registrar LLC
Mock Registrar LLC
the same name server
ns1.mock-dns.example
ns1.mock-dns.example
the same name server
ns2.mock-dns.example
ns2.mock-dns.example
Evidence per site 2
| site | ip | kit |
|---|---|---|
| shopnova-support-center.com | ● | ● |
| shopnova-verification.com | ● | ● |
⚿
Phishing kit · 2 sites
Operation 4 · Phishing kit — collects passwords or card details
97
2sites
1brand
2026-09-22
→ 2026-09-30bought
→ 2026-09-30bought
2/2credential form
Because they share
certificatebbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb...
80%
server198.51.100.77
80%
page lookscreenshot be37c1cd4c
30%
Each of the 2 domains collects passwords or card details. Registered over 8 days (2026-09-22 → 2026-09-30). 2/2 credential form.
| Registrar | Mock Registrar LLC ×2 |
|---|---|
| Hosting | Fast VPS LLC (hoster) ×2 |
First step: One bulk abuse report to Mock Registrar LLC
Details
How to stop it 2
1. One bulk abuse report to Mock Registrar LLC
2 domains are registered there. List them all in one report, with the screenshots from the evidence packages.
shopnowa.com, shoqnova.com
2. Report the hosting provider Fast VPS LLC
The provider can disable the servers that host these pages.
shopnowa.com, shoqnova.com
Who is with whom 1 cluster
Sites that share exactly the same things are shown together, so many links with the same sites read as one line.
shopnowa.comshoqnova.com
2 sites share:
certificate bbbbbbbbbbbbbbbbbbb... 80%server 198.51.100.77 80%page look screenshot be37c1cd4c 30%
Who against whom · how sure we are that two sites are one operation (hover a cell for what ties them)
shopnowa.com | shoqnova.com | |
|---|---|---|
| shopnowa.com | 97 | |
| shoqnova.com | 97 |
Who shares what 2 of the 2 sites are on one server
Same server (address) 1
| 198.51.100.77 Fast VPS LLC · hoster |
2 sites shopnowa.com, shoqnova.com |
TLS certificates 1
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb... | 2 sites shopnowa.com, shoqnova.com |
Name servers 2
| ns1.mock-dns.example | 2 sites shopnowa.com, shoqnova.com |
| ns2.mock-dns.example | 2 sites shopnowa.com, shoqnova.com |
Registrars 1
| Mock Registrar LLC | 2 sites shopnowa.com, shoqnova.com |
Pages that look the same 1
| screenshot be37c1cd4c | 2 sites shopnowa.com, shoqnova.com |
Favicons 1
| -2029202433 | 2 sites shopnowa.com, shoqnova.com |
Site by site 2
| site | registered | registrar | server(s) | hosting | name servers | ends on |
|---|---|---|---|---|---|---|
| shopnowa.com | 2026-09-22 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnowa.com |
| shoqnova.com | 2026-09-30 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shoqnova.com |
What ties them together 3
the same TLS certificate80%
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb · 2 sites
bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb · 2 sites
the same server80%
198.51.100.77 · 2 sites · Fast VPS LLC
198.51.100.77 · 2 sites · Fast VPS LLC
a page that looks the same30% · hint
screenshot be37c1cd4c · 2 sites
screenshot be37c1cd4c · 2 sites
Also in common, but weak (they never group sites):
the same favicon
-2029202433
-2029202433
the same registrar
Mock Registrar LLC
Mock Registrar LLC
the same name server
ns1.mock-dns.example
ns1.mock-dns.example
the same name server
ns2.mock-dns.example
ns2.mock-dns.example
Evidence per site 2
| site | certificate | ip | kit look |
|---|---|---|---|
| shopnowa.com | ● | ● | ● |
| shoqnova.com | ● | ● | ● |
NO STRONG LINK TO THE OTHERS · 16
footstyle-il.com · Look-alike domainskicksmart-il.co.il · Look-alike domainsonestyle-shopping.com · Look-alike domainsrunnerhub-sale.com · Look-alike domainsshopnova--sneakers.com · Phishing kitshopnova-careers.com · Look-alike domainsshopnova-coupons.com · Look-alike domainsshopnova-giftcard.com · Phishing kitshopnova-id-check.com · Look-alike domainsshopnova-outlet-store.com · Look-alike domainsshopnova-refund.net · Phishing kitshopnova-status.com · Look-alike domainsshopnova-verify.com · Phishing kitstepcloud-store.com · Look-alike domainsstylehub-israel.com · Look-alike domainsxn--shopnov-8fg.com · Phishing kit
SOCIAL IMPERSONATION · 1 (pages, not infrastructure: they have no server to compare)
The pattern · what these attacks have in common
26 sites (14 critical, 7 high, 5 medium). registered over 2399 days (2020-03-17 → 2026-10-11); names: 14 × the brand plus extra words, 3 × a typo of the brand, 1 × look-alike characters, 1 × the brand name on another ending; endings: .com (22), .net (2), .il (1); hosted in United States (7), Netherlands (4), India (3).
- registered over 2399 days (2020-03-17 → 2026-10-11)
- names: 14 × the brand plus extra words, 3 × a typo of the brand, 1 × look-alike characters, 1 × the brand name on another ending
- endings: .com (22), .net (2), .il (1)
- hosted in United States (7), Netherlands (4), India (3)
- the kit copies the brand's favicon (14/26); asks for a password (13/26)
Registered, oldest first:
2020-03-17 shopnova-press.com2021-04-21 shopnova-careers.com2022-02-15 shopnova-status.com2023-03-22 stepcloud-store.com2023-08-24 shopnova--sneakers.com2023-09-10 stylehub-israel.com2024-04-25 shopnova-outlet-store.com2026-03-26 shopnova-coupons.com2026-08-23 kicksmart-il.co.il2026-09-02 footstyle-il.com2026-09-17 shopnova-support-center.com2026-09-21 onestyle-shopping.com2026-09-22 shopnowa.com2026-09-30 runnerhub-sale.com2026-09-30 shoqnova.com2026-10-03 shopnova-refund.net2026-10-04 shopnova.co2026-10-06 shopnova-verification.com2026-10-07 shopnova-verify.com2026-10-08 shopnova-giftcard.com2026-10-08 shopnova-login.com2026-10-08 xn--shopnov-8fg.com2026-10-09 shopn0va.com2026-10-10 secure-shopnova.com2026-10-10 shopnova-id-check.com2026-10-11 shopnova-account.net
What counts as a connection · switch a whole kind off if it proves nothing to you
For example the Cloudflare account or the registrar: many unrelated sites share them. Switching a kind off takes it out of the analysis and the map is analysed again. To leave out only one thing, use the red “not evidence” button next to it in the cards above.