Because the same TLS certificate bbbbbbbbbbbbbbbbbbbbbbbbbbb... 80%the same server 198.51.100.77 80%a page that looks the same screenshot be37c1cd4c 30%
Each of the 2 domains collects passwords or card details. Registered over 8 days (2026-09-22 → 2026-09-30). 2/2 credential form.
- 2/2 credential form
How to stop it · the shortest way, first
The sites · 2
| Site | Severity | Registered | Registrar | Server(s) | Hosting | Name servers | Ends on |
|---|---|---|---|---|---|---|---|
| shopnowa.com | critical | 2026-09-22 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shopnowa.com |
| shoqnova.com | critical | 2026-09-30 | Mock Registrar LLC | 198.51.100.77 | Fast VPS LLC (hoster) | ns1.mock-dns.example, ns2.mock-dns.example | shoqnova.com |
Who is with whom · 1 cluster
2 of the 2 sites are on one server. Sites that share exactly the same things are shown together, so a long list of links reads as one line.
Who against whom
How sure we are that two sites are one operation (the darker the cell, the surer). The number is shown from 75%, where two sites count as one operation.
shopnowa.com | shoqnova.com | |
|---|---|---|
| shopnowa.com | 97 | |
| shoqnova.com | 97 |
Who shares what · every shared server, certificate, registrant and more
Same server (address) · 1
| Value | Strength | Shared by |
|---|---|---|
| 198.51.100.77 Fast VPS LLC · hoster |
80% proof |
2 sites shopnowa.com, shoqnova.com |
TLS certificates · 1
| Value | Strength | Shared by |
|---|---|---|
| bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 80% proof |
2 sites shopnowa.com, shoqnova.com |
Name servers · 2
| Value | Strength | Shared by |
|---|---|---|
| ns1.mock-dns.example | 10% common |
2 sites shopnowa.com, shoqnova.com |
| ns2.mock-dns.example | 10% common |
2 sites shopnowa.com, shoqnova.com |
Registrars · 1
| Value | Strength | Shared by |
|---|---|---|
| Mock Registrar LLC | 10% common |
2 sites shopnowa.com, shoqnova.com |
Pages that look the same · 1
| Value | Strength | Shared by |
|---|---|---|
| screenshot be37c1cd4c | 30% a hint |
2 sites shopnowa.com, shoqnova.com |
Favicons · 1
| Value | Strength | Shared by |
|---|---|---|
| -2029202433 | 10% common |
2 sites shopnowa.com, shoqnova.com |
Toolkit · what the attacker uses
| Kind | What |
|---|---|
| Registrars | Mock Registrar LLC ×2 |
| Hosting | Fast VPS LLC (hoster) ×2 |
| Redirect hosts | – |
| Name servers | ns1.mock-dns.example ×2ns2.mock-dns.example ×2 |
| Certificate issuers | C=US O=Mock Trust Services CN=MT1 ×2 |
When the domains were registered · a ring = several bought within days of each other
| Registered | Site |
|---|---|
| 2026-09-22 | shopnowa.com |
| 2026-09-30 | shoqnova.com |
Evidence per site · which site has which tie
| Site | certificate | ip | kit look |
|---|---|---|---|
| shopnowa.com | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | screenshot be37c1cd4c |
| shoqnova.com | bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb | 198.51.100.77 | screenshot be37c1cd4c |
Also in common, but weak · they never group sites
| Kind | Value | Sites |
|---|---|---|
| the same favicon | -2029202433 | 2 |
| the same registrar | Mock Registrar LLC | 2 |
| the same name server | ns1.mock-dns.example | 2 |
| the same name server | ns2.mock-dns.example | 2 |
Confidence is the weakest tie that holds the group together. Every tie has a weight: how likely it is that two sites sharing it are one operation. A server on a CDN is no evidence; a registrar or a name server never ties two sites on its own. This report was generated from the evidence BrandWatch holds today; searching for more sites of this operation is a separate step the analyst starts.