Because the same server 203.0.113.133 80%the same page code page 6004976ec5 60%
Each of the 2 domains collects passwords or card details. Registered over 19 days (2026-09-17 → 2026-10-06). 2/2 credential form.
- 2/2 credential form
How to stop it · the shortest way, first
The sites · 2
| Site | Severity | Registered | Registrar | Server(s) | Hosting | Name servers | Ends on |
|---|---|---|---|---|---|---|---|
| shopnova-support-center.com | critical | 2026-09-17 | Mock Registrar LLC | 203.0.113.133 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnova-support-center.com |
| shopnova-verification.com | critical | 2026-10-06 | Mock Registrar LLC | 203.0.113.133 | Mock Hosting LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnova-verification.com |
Who is with whom · 1 cluster
2 of the 2 sites are on one server. Sites that share exactly the same things are shown together, so a long list of links reads as one line.
Who against whom
How sure we are that two sites are one operation (the darker the cell, the surer). The number is shown from 75%, where two sites count as one operation.
shopnova-support-center.com | shopnova-verification.com | |
|---|---|---|
| shopnova-support-center.com | 92 | |
| shopnova-verification.com | 92 |
Who shares what · every shared server, certificate, registrant and more
Same server (address) · 1
| Value | Strength | Shared by |
|---|---|---|
| 203.0.113.133 Mock Hosting LLC · hoster |
80% proof |
2 sites shopnova-support-center.com, shopnova-verification.com |
Name servers · 2
| Value | Strength | Shared by |
|---|---|---|
| ns1.mock-dns.example | 10% common |
2 sites shopnova-support-center.com, shopnova-verification.com |
| ns2.mock-dns.example | 10% common |
2 sites shopnova-support-center.com, shopnova-verification.com |
Registrars · 1
| Value | Strength | Shared by |
|---|---|---|
| Mock Registrar LLC | 10% common |
2 sites shopnova-support-center.com, shopnova-verification.com |
Same page code · 1
| Value | Strength | Shared by |
|---|---|---|
| page 6004976ec5 | 60% a hint |
2 sites shopnova-support-center.com, shopnova-verification.com |
Favicons · 1
| Value | Strength | Shared by |
|---|---|---|
| -2029202433 | 10% common |
2 sites shopnova-support-center.com, shopnova-verification.com |
Toolkit · what the attacker uses
| Kind | What |
|---|---|
| Registrars | Mock Registrar LLC ×2 |
| Hosting | Mock Hosting LLC (hoster) ×2 |
| Redirect hosts | – |
| Name servers | ns1.mock-dns.example ×2ns2.mock-dns.example ×2 |
| Certificate issuers | C=US O=Mock Trust Services CN=MT1 ×2 |
When the domains were registered · a ring = several bought within days of each other
| Registered | Site |
|---|---|
| 2026-09-17 | shopnova-support-center.com |
| 2026-10-06 | shopnova-verification.com |
Evidence per site · which site has which tie
| Site | ip | kit |
|---|---|---|
| shopnova-support-center.com | 203.0.113.133 | page 6004976ec5 |
| shopnova-verification.com | 203.0.113.133 | page 6004976ec5 |
Also in common, but weak · they never group sites
| Kind | Value | Sites |
|---|---|---|
| the same favicon | -2029202433 | 2 |
| the same registrar | Mock Registrar LLC | 2 |
| the same name server | ns1.mock-dns.example | 2 |
| the same name server | ns2.mock-dns.example | 2 |
Confidence is the weakest tie that holds the group together. Every tie has a weight: how likely it is that two sites sharing it are one operation. A server on a CDN is no evidence; a registrar or a name server never ties two sites on its own. This report was generated from the evidence BrandWatch holds today; searching for more sites of this operation is a separate step the analyst starts.