shopnova-refund.net campaign · 1 server · 1 finding
One confirmed site (shopnova-refund.net) led to 1 server hosting 2 ShopNova look-alikes — the same operator.
Infrastructure graph · drag nodes · solid = included, dashed = excluded by triage ⚙ budgeted pivot · ≤2 hops · ≤100 nodes
Dashed nodes were excluded by triage (reverse-IP noise, or the brand's own / whitelisted sites shown only for context). Edges: passive_dns · cert · favicon · tracking_id · reverse_whois
Actor profile · what ties the operation together
| Registrant | REDACTED FOR PRIVACY |
|---|---|
| Servers | 203.0.113.102 |
| Certificates | — |
| Tracking ids | none observed |
| Investigated | 2026-10-14 07:49:46 |
Export · indicators your firewall or SIEM can block
Domains, IPs, certificate hashes and tracking IDs, each with first_seen and the evidence row it came from. STIX 2.1 imports directly into MISP, OpenCTI or Splunk ES. Mapped indicators also feed the Infrastructure signals of later scans.
Findings in this map
Co-hosted triage · every node and why it is in or out
Triage keeps a neighbour only if it shares a link signal (certificate, favicon, tracking ID, registrant) or looks like the brand; everything else on a shared server is reverse-IP noise. The brand's own and whitelisted sites are shown for context only.
| Node | Type | Decision | Reason | Attributes |
|---|---|---|---|---|
| bluewater-aquatics.com | domain | excluded | co-hosted neighbour without link signals (reverse-IP noise); AI triage: not phishing (35%) | AI: not phishing (35%); no credential or payment capture |
| shopnova-refund.net critical | domain | included | seed finding | |
| shopnovaa.com | domain | included | brand pattern in hostname | |
| 203.0.113.102 | ip | included | resolved by the seed | org: Mock Hosting LLC asn: 64524 ports: 80, 443 |