87
risk ?
shopnova-giftcard.com
Registered 4 days ago. Puts the ShopNova name in its address, copies ShopNova's favicon, homepage and login form and asks for a password. It hides from security scanners: the real page only appears to a normal visitor (home IP / browser).
registered 4 days ago
found by Certificate logs, Analyst URL scan
confidence ?100%
domain name · https://shopnova-giftcard.com/
hosted 
203.0.113.136
registrar Mock Registrar LLC
203.0.113.136
registrar Mock Registrar LLC
Hides from scanners: the real page was revealed by BrandWatch's probes — see Looks like ShopNova.
THREAT INTEL · what public blocklists say about this site — each card opens the lookup
VirusTotal↗
not in VirusTotal yet (unknown ≠ clean)
Google Safe Browsing↗
not on Google's list yet — browsers do not warn
Not on public blocklists yet — they lag by hours or days, and this domain is 4 days old. BrandWatch found it first; unknown is never treated as safe.
What do I do · get it taken down
✓ Confirmed phishing ·
Attack infrastructure:
mapped → open the map
Notes · for you and the next analyst — kept with the finding, never edited, also in Activity
No notes yet.
Explain Finding — why it was flagged · every signal, its points and the evidence behind it
| Signal | Group | Points | Evidence |
|---|---|---|---|
| hides from datacenter IPs cloaking_ip_based | Evasion | +25 | datacenter IPs get a decoy page; a residential IP gets the phishing page |
| identical favicon favicon_exact | Visual | +22 | favicon mmh3 -2029202433 equals the brand's favicon hash |
| looks like the real site screenshot_similarity_ge_90 | Visual | +18 | homepage screenshot is 100% similar to the brand's (pHash) |
| asks for a password credential_form | Behaviour | +14 | page contains a password field |
| brand name in the domain brand_exact_in_domain | Identity | +12 | brand 'shopnova' appears inside the domain label 'shopnova-giftcard' |
| cloned login form login_dom_similarity | Visual | +12 | login form markup is 100% identical to the brand's |
| registered < 7 days ago age_lt_7d | Freshness | +10 | domain registered 4 day(s) ago |
| page title claims the brand title_claims_brand | Behaviour | +10 | the page calls itself the brand: <title>ShopNova — Sign in</title> |
show all 13 signals, bonuses
| brand + extra word combosquat | Identity | +8 | 'shopnova-giftcard' combines the brand with extra words |
| registered < 30 days ago age_lt_30d | Freshness | +6 | domain registered 4 days ago |
| brand words in the text brand_keywords_in_content | Behaviour | +6 | brand terms in content: shop, shopnova |
| urgent lure wording lure_language | Behaviour | +6 | lure phrases: verify your account; unusual activity; your account will be |
| same colours palette_match | Visual | +5 | 100% of the page's dominant colours match the brand's |
| combination bonus | cluster | +15 | favicon_exact + credential_form + brand_exact_in_domain |
| combination bonus | cluster | +15 | favicon_exact + login_dom_similarity + cloaking_ip_based |
How the score adds up
⚙ deterministic · versioned Raw 130 of 150 → normalised to 87 / 100 · severity raised to critical by the rule “pixel-perfect clone with a login form (favicon + screenshot + password form)”.
Thresholds: Medium 25 · High 50 · Critical 75 · scoring v2-c213b21d
Other rules that fired: a clone that hides from scanners (≥ critical); a days-old look-alike asking for a password (≥ high); titled as the brand and asking for a password (≥ high)
open the arithmetic ↗ — this site's section of the scan trace
Group caps ? · stop correlated evidence from double counting
Identity
20 / 20
Visual
57 → 30
Behaviour
36 → 30
Infrastructure
0 / 20
Reputation
0 / 15
Freshness
16 → 10
Evasion
25 / 25
Confidence ? · 100%
| Breadth (5 independent groups) | +70 |
| Hard confirmers favicon_exact, cloaking_ip_based | +30 |
| Evidence completeness | +15 |
| Provider agreement | +0 |
| Unavailable evidence | 0 |
| Single weak signal | 0 |
Suspect vs. official similarity 100%
what a scanner sees (datacenter IP)
what a victim sees (home IP)
the real ShopNova ?
The kit shows a harmless decoy to security scanners and the phishing page to real visitors. BrandWatch keeps both — the decoy is evidence of evasion.
Cloaking multi-probe ? ⚙ Tier 3/4 multi-probe real page revealed by residential
| Probe | Profile | Login form | Diverged | Note |
|---|---|---|---|---|
| bot | bot | no | same | |
| param | datacenter | no | same | |
| referer | referer | no | same | |
| residential | residential | yes | diverged |
Fetched several ways — a crawler user-agent, a victim-style link (?email=), a Google referer, a phone (when chosen in Settings → Proxy) and a real home or phone-network IP (Tier 4). Only the residential view showed the login form, so the score uses what a victim sees. Residential (Tier 4): used. Residential IPs are used to look, never to interact.
0
VirusTotal · security vendors
0 of 90 engines flag this domain
malicious 0 · suspicious 0 · community reputation 0
Server reputation · AbuseIPDB
25 or more = several defenders reported abuse from this server.
Categories
uncategorized Mock Category Service
JARM
a77ac5af3e526d484f16b924e8b00bae7e32e1beb766e787b41b852a3f315c
Engines flagged first
| Engine | Category | Result | Method |
|---|---|---|---|
| BitDefender | harmless | clean | blacklist |
| CRDF | harmless | clean | blacklist |
| ESET | harmless | clean | blacklist |
| Fortinet | harmless | clean | blacklist |
| Google Safebrowsing | harmless | clean | blacklist |
| Kaspersky | harmless | clean | blacklist |
| Netcraft | harmless | clean | blacklist |
| OpenPhish | harmless | clean | blacklist |
| Phishtank | harmless | clean | blacklist |
| Quttera | harmless | clean | blacklist |
| Sophos | harmless | clean | blacklist |
| Webroot | harmless | clean | blacklist |
Look it up elsewhere
Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.
Registration data (RDAP)
- Name
- shopnova-giftcard.com
- registration
- 2026-10-10
- Status
- —
- DNSSEC
- —
Registrar & abuse contact
- Registrar
- Mock Registrar LLC
- Abuse email
- —
- registrant org
- REDACTED FOR PRIVACY
Nameservers
—Current WHOIS record (VirusTotal)
Domain Name: SHOPNOVA-GIFTCARD.COM
Registrar: Mock Registrar LLC
Registrar Abuse Contact Email: abuse@mock-registrar.example
Creation Date: 2026-10-10T00:00:00Z
Name Server: NS1.MOCK-DNS.EXAMPLE
Registrant Country: US
WHOIS history · every WHOIS snapshot WhoisXML has recorded for shopnova-giftcard.com
Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.
First registered
2026-10-10
Mock Registrar LLC
Snapshots
3
2026-10-10 → 2026-10-13
Owners seen
1 visible
0 owner change(s)
Registrars
1
0 transfer(s) · Mock Registrar LLC
Owner details now
Hidden
privacy on since 2026-10-11
Owner details visible before privacy was switched on
Seen 2026-10-10, hidden since 2026-10-11. Today's WHOIS shows only the privacy service; this is who registered it.
- name
- Jordan Marlow
- organization
- JM Digital Media
- jm.digital.media@mailbox.example
- telephone
- +44.7700900123
- street
- 14 Albion Street (demo)
- city
- Leeds
- country
- GB
Same owner e-mail on other domains in this workspace
jm.digital.media@mailbox.example → shopnova-refund.net
Found in other domains' WHOIS history and in the WHOIS evidence of your scans — no extra API call. One operator, several kits.
TIMELINE
- 2026-10-10Registered by Jordan Marlow (JM Digital Media, jm.digital.media@mailbox.example)via Mock Registrar LLC · first WHOIS snapshot 2026-10-10
- 2026-10-11Privacy switched on — owner details hiddenuntil then WHOIS showed name: Jordan Marlow, organization: JM Digital Media, email: jm.digital.media@mailbox.example, telephone: +44.7700900123; now 'Privacy service provided by WhoisProxy (demo)'
SNAPSHOTS · CHANGED FIELDS MARKED
| Seen | Registrar | Registrant | Created · expires |
|---|---|---|---|
| 2026-10-13 | Mock Registrar LLC | hidden · Privacy service provided by WhoisProxy (demo) (IS) | 2026-10-10 · 2027-10-10 |
raw WHOIS · 2026-10-13Domain Name: SHOPNOVA-GIFTCARD.COM
Registrar: Mock Registrar LLC
Creation Date: 2026-10-10T00:00:00Z
Updated Date: 2026-10-13T00:00:00Z
Registry Expiry Date: 2027-10-10T00:00:00Z
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: Privacy service provided by WhoisProxy (demo)
Registrant Email: redacted-contact@whoisproxy.example
Registrant Country: IS
Registrant City: Reykjavik
Name Server: NS1.MOCK-DNS.EXAMPLE
Name Server: NS2.MOCK-DNS.EXAMPLE | |||
| 2026-10-11 | Mock Registrar LLC | hidden · Privacy service provided by WhoisProxy (demo) (IS) | 2026-10-10 · 2027-10-10 |
raw WHOIS · 2026-10-11Domain Name: SHOPNOVA-GIFTCARD.COM
Registrar: Mock Registrar LLC
Creation Date: 2026-10-10T00:00:00Z
Updated Date: 2026-10-11T00:00:00Z
Registry Expiry Date: 2027-10-10T00:00:00Z
Registrant Name: REDACTED FOR PRIVACY
Registrant Organization: Privacy service provided by WhoisProxy (demo)
Registrant Email: redacted-contact@whoisproxy.example
Registrant Country: IS
Registrant City: Reykjavik
Name Server: NS1.MOCK-DNS.EXAMPLE
Name Server: NS2.MOCK-DNS.EXAMPLE | |||
| 2026-10-10 | Mock Registrar LLC | Jordan Marlow · JM Digital Media · jm.digital.media@mailbox.example · +44.7700900123 (GB) | 2026-10-10 · 2027-10-10 |
raw WHOIS · 2026-10-10Domain Name: SHOPNOVA-GIFTCARD.COM
Registrar: Mock Registrar LLC
Creation Date: 2026-10-10T00:00:00Z
Updated Date: 2026-10-10T00:00:00Z
Registry Expiry Date: 2027-10-10T00:00:00Z
Registrant Name: Jordan Marlow
Registrant Organization: JM Digital Media
Registrant Email: jm.digital.media@mailbox.example
Registrant Telephone: +44.7700900123
Registrant Country: GB
Registrant City: Leeds
Registrant Street: 14 Albion Street (demo)
Name Server: NS1.MOCK-DNS.EXAMPLE
Name Server: NS2.MOCK-DNS.EXAMPLE | |||
Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .
DNS records source: VirusTotal
A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).
| Type | TTL | Value |
|---|---|---|
| A | 300 | 203.0.113.136 |
| AAAA | 300 | 2001:db8::cd32 |
| NS | 21600 | ns1.mock-dns.example |
| NS | 21600 | ns2.mock-dns.example |
| MX | 3600 | mail.shopnova-giftcard.com prio 10 |
| SOA | 1800 | ns1.mock-dns.example rname hostmaster.shopnova-giftcard.com · serial 2026100801 |
HTTPS certificate from VirusTotal
- Common name
- shopnova-giftcard.com
- Issuer
- C=US O=Mock Trust Services CN=MT1
- Valid
- 2026-09-20 00:00:00 → 2026-12-19 00:00:0032% of the validity period elapsed
- Alt names (2)
- shopnova-giftcard.com www.shopnova-giftcard.com
- SHA-256
- 1617791c91ac3c37ff438af0e1255bcc2a5583060123307bea71520af64876e7 · crt.sh ↗
serial, signature, key, TLS and the full certificate
- Subject
- CN=shopnova-giftcard.com
- Serial
- 512c7c06
- Signature
- sha256ECDSA
- Public key
- EC secp256r1
- SHA-1
- 786ba492bffb13c228ab3f22fedf50cdc47e2a1e
{
"cert_signature": {
"signature_algorithm": "sha256ECDSA"
},
"extensions": {
"subject_alternative_name": [
"shopnova-giftcard.com",
"www.shopnova-giftcard.com"
]
},
"issuer": {
"C": "US",
"CN": "MT1",
"O": "Mock Trust Services"
},
"public_key": {
"algorithm": "EC",
"ec": {
"oid": "secp256r1"
}
},
"serial_number": "512c7c06",
"subject": {
"CN": "shopnova-giftcard.com"
},
"thumbprint": "786ba492bffb13c228ab3f22fedf50cdc47e2a1e",
"thumbprint_sha256": "1617791c91ac3c37ff438af0e1255bcc2a5583060123307bea71520af64876e7",
"validity": {
"not_after": "2026-12-19 00:00:00",
"not_before": "2026-09-20 00:00:00"
},
"version": "V3"
}
0
203.0.113.136
India · Mumbai · AS64604 · Mock Hosting LLC · 203.0.113.0/24 · RIPE NCC
0 of 94 engines flag this IP
· 5 sites hosted, 2 flagged · 4 communicating files
Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days
57/ 100
50 report(s) from 10 reporter(s) · last 2026-10-13 19:49
Data Center/Web Hosting/Transit · Mock Hosting LLC
A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.
SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)
| Last resolved | Detections | Domain | |
|---|---|---|---|
| 2026-10-13 | 5/ 95 | shopnova-giftcard.com | VT ↗ · urlscan ↗ |
| 2026-10-07 | 5/ 95 | wallet-sync-3136.online | VT ↗ · urlscan ↗ |
| 2026-10-11 | 0/ 90 | secure-login-3136.top | VT ↗ · urlscan ↗ |
| 2026-10-05 | 0/ 90 | support-desk-3136.site | VT ↗ · urlscan ↗ |
| 2026-10-09 | 0/ 90 | verify-account-3136.xyz | VT ↗ · urlscan ↗ |
COMMUNICATING FILES
| Scanned | Detections | Type | Name |
|---|---|---|---|
| 2026-10-09 | 6/ 66 | Android | Draky and the Twilight Castle.apk |
| 2026-09-21 | 5/ 66 | Android | Orbit - Igra s gravitaciey.apk |
| 2026-09-12 | 4/ 66 | invoice_4411.pdf | |
| 2026-09-30 | 0/ 66 | REMITTANCE 2-For-Cokecanada.pdf |
HISTORICAL WHOIS (IP block)
2026-09-12 · Mock Registrar LLC
IP WHOIS record
inetnum: 203.0.113.0 - 203.0.113.255
org-name: Mock Hosting LLC
abuse-mailbox: abuse@mock.example
engine verdicts for this IP (12)
| Engine | Category | Result |
|---|---|---|
| BitDefender | harmless | clean |
| CRDF | harmless | clean |
| ESET | harmless | clean |
| Fortinet | harmless | clean |
| Google Safebrowsing | harmless | clean |
| Kaspersky | harmless | clean |
| Netcraft | harmless | clean |
| OpenPhish | harmless | clean |
| Phishtank | harmless | clean |
| Quttera | harmless | clean |
| Sophos | harmless | clean |
| Webroot | harmless | clean |
urlscan.io scan
not flagged by urlscan
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-14 09:49
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-14 09:49
title: shopnova-giftcard.com - Sign in
domains contacted by the page (2)
shopnova-giftcard.com · cdn.mock-static.example
Similar sites 29
Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.
Same page (identical document hash) 4hash:3a87fadf5198e2ca55ec1a10281532b40759e023e791e2cd6943aadaeba5c5e8
the same HTML served elsewhere — the same phishing kit
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-09-16 | — | shopn0va.com |
urlscan ↗ · VT ↗ | shopn0va.com - Sign in |
| 2026-09-15 | — | shopnova-login.com |
urlscan ↗ · VT ↗ | shopnova-login.com - Sign in |
| 2026-09-14 | — | secure-shopnova.com |
urlscan ↗ · VT ↗ | secure-shopnova.com - Sign in |
| 2026-09-08 | — | shopnova.co |
urlscan ↗ · VT ↗ | shopnova.co - Sign in |
Same server 0page.ip:203.0.113.66
other pages scanned on the same IP
noneSame brand name 25page.domain:*shopnova*
domains containing the brand name
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-10-14 | — | shopnova-partners.com |
urlscan ↗ · VT ↗ | shopnova-partners.com - Sign in |
| 2026-10-13 | — | shopnova-blog.net |
urlscan ↗ · VT ↗ | shopnova-blog.net - Sign in |
| 2026-10-12 | — | shopnovafans.com |
urlscan ↗ · VT ↗ | shopnovafans.com - Sign in |
| 2026-10-11 | — | shopnova-reviews.com |
urlscan ↗ · VT ↗ | shopnova-reviews.com - Sign in |
| 2026-10-10 | — | shopnova-careers.com |
urlscan ↗ · VT ↗ | shopnova-careers.com - Sign in |
| 2026-10-09 | — | shopnova-deals.com |
urlscan ↗ · VT ↗ | shopnova-deals.com - Sign in |
| 2026-10-08 | — | shopnova-status.com |
urlscan ↗ · VT ↗ | shopnova-status.com - Sign in |
| 2026-10-07 | — | shopnova-community.org |
urlscan ↗ · VT ↗ | shopnova-community.org - Sign in |
| 2026-10-06 | — | shopnova-press.com |
urlscan ↗ · VT ↗ | shopnova-press.com - Sign in |
| 2026-10-05 | — | shopnova-events.com |
urlscan ↗ · VT ↗ | shopnova-events.com - Sign in |
| 2026-09-24 | — | shopnova.com |
urlscan ↗ · VT ↗ | shopnova.com - Sign in |
| 2026-09-23 | — | www.shopnova.com |
urlscan ↗ · VT ↗ | www.shopnova.com - Sign in |
| 2026-09-22 | — | shopnova.co.il |
urlscan ↗ · VT ↗ | shopnova.co.il - Sign in |
| 2026-09-13 | — | shopnova-verify.com |
urlscan ↗ · VT ↗ | shopnova-verify.com - Sign in |
| 2026-09-10 | — | shopnova-account.net |
urlscan ↗ · VT ↗ | shopnova-account.net - Sign in |
| 2026-09-09 | — | shopnova-support-center.com |
urlscan ↗ · VT ↗ | shopnova-support-center.com - Sign in |
| 2026-09-05 | — | shopnova-refund.net |
urlscan ↗ · VT ↗ | shopnova-refund.net - Sign in |
| 2026-09-04 | — | shopnova-verification.com |
urlscan ↗ · VT ↗ | shopnova-verification.com - Sign in |
| 2026-09-03 | — | shopnova--sneakers.com |
urlscan ↗ · VT ↗ | shopnova--sneakers.com - Sign in |
| 2026-09-02 | — | shopnova-eu.com |
urlscan ↗ · VT ↗ | shopnova-eu.com - Sign in |
| 2026-09-01 | — | shopnova-id-check.com |
urlscan ↗ · VT ↗ | shopnova-id-check.com - Sign in |
| 2026-08-20 | — | shopnova-support.com |
urlscan ↗ · VT ↗ | shopnova-support.com - Sign in |
| 2026-08-19 | — | shopnova-review.com |
urlscan ↗ · VT ↗ | shopnova-review.com - Sign in |
| 2026-08-18 | — | shopnova-coupons.com |
urlscan ↗ · VT ↗ | shopnova-coupons.com - Sign in |
| 2026-08-17 | — | shopnova-login-help.com |
urlscan ↗ · VT ↗ | shopnova-login-help.com - Sign in |
Passive DNS replication 1
Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.
| Date resolved | Detections (IP) | IP |
|---|---|---|
| 2026-09-27 | 3/ 92 | 203.0.113.136 |
Subdomains 3
| Host | Detections |
|---|---|
| login.shopnova-giftcard.com | 2/ 92 |
| mail.shopnova-giftcard.com | 0/ 90 |
| www.shopnova-giftcard.com | 0/ 90 |
Communicating files 4
Malware samples that contacted this domain while being analysed.
| Scanned | Detections | Type | Name |
|---|---|---|---|
| 2026-10-09 | 6/ 66 | Android | Draky and the Twilight Castle.apk |
| 2026-09-21 | 5/ 66 | Android | Orbit - Igra s gravitaciey.apk |
| 2026-09-12 | 4/ 66 | invoice_4411.pdf | |
| 2026-09-30 | 0/ 66 | REMITTANCE 2-For-Cokecanada.pdf |
Historical WHOIS · VirusTotal 1
2026-09-14 · Mock Registrar LLC
- Registrant Organization
- REDACTED FOR PRIVACY
- Registrant Country
- US
- Name Server
- NS1.MOCK-DNS.EXAMPLE
Historical certificates 2 VT · 1 CT
| First seen | Subject | Issuer | Thumbprint |
|---|---|---|---|
| 2026-10-07 | shopnova-giftcard.com | Mock Trust Services | 6ea363016a23452ad2d055e7… |
| 2026-09-12 | shopnova-giftcard.com | Mock Trust Services | 9b8c691444bf623ccde244ba… |
CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains
| Not before | Names | Issuer |
|---|---|---|
| 2026-09-30 | shopnova-giftcard.com, www.shopnova-giftcard.com | C=US, O=Let's Encrypt, CN=R3 |
Observation timeline
- 2026-10-12 06:41:51 · HTTP 200 · state new · datacenter · content changed · 5e937f2c8a21 · screenshot
- 2026-10-12 06:41:51 · HTTP 200 · state new · residential · content changed · 6004976ec5ea · screenshot
- 2026-10-12 06:41:56 · HTTP 200 · state flagged · datacenter · 5e937f2c8a21 · screenshot
- 2026-10-12 06:41:56 · HTTP 200 · state flagged · residential · content changed · 6004976ec5ea · screenshot
- 2026-10-12 06:46:04 · HTTP 200 · state flagged · datacenter · 5e937f2c8a21 · screenshot
- 2026-10-12 06:46:04 · HTTP 200 · state flagged · residential · content changed · 6004976ec5ea · screenshot
- 2026-10-12 06:46:09 · HTTP 200 · state flagged · datacenter · 5e937f2c8a21 · screenshot
- 2026-10-12 06:46:09 · HTTP 200 · state flagged · residential · content changed · 6004976ec5ea · screenshot
first seen 2026-10-12 06:41 · scans 4 · next 2026-10-12 12:46 · candidate state flagged · WHOIS history →
Score history
| When | Score | Severity | Confidence | Version |
|---|---|---|---|---|
| 2026-10-12 06:41:51 | 87 | critical | 100% | v2-c213b21d |
| 2026-10-12 06:41:56 | 87 | critical | 100% | v2-c213b21d |
| 2026-10-12 06:46:04 | 87 | critical | 100% | v2-c213b21d |
| 2026-10-12 06:46:09 current | 87 | critical | 100% | v2-c213b21d |
Evidence · chain of custody ? ⚙ immutable · DB-enforced
Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.
| Observed (UTC) | Type | Role | Source | SHA-256 | Details | |
|---|---|---|---|---|---|---|
| 2026-10-12 06:46:09 | favicon · residential view | primary | probe:residential | ffd6e7f7b2b08577 | mmh3: -2029202433 phash: dc966349c3693c96 probe: residential +1 | artifact |
| 2026-10-12 06:46:09 | screenshot · residential view | primary | probe:residential | b3ad05659eee391c | phash: be37c1cd4c483137 dhash: f04f0c396d5c55ab palette: ['#f5f4fb', '#412db1', '#ff… +2 | artifact |
| 2026-10-12 06:46:09 | html · residential view | primary | probe:residential | 6004976ec5ea76af | title: ShopNova — Sign in forms: 1 parked: False +2 | artifact |
| 2026-10-12 06:46:09 | http · residential view | primary | mock:playwright | 6004976ec5ea76af | probe: residential status: 200 content_sha256: 6004976ec5ea76af96ce7ba48c9… +3 | |
| 2026-10-12 06:46:09 | http · referer view | supporting | mock:playwright | 5e937f2c8a210286 | probe: referer status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:46:09 | http · param view | supporting | mock:playwright | 5e937f2c8a210286 | probe: param status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:46:09 | http · bot view | supporting | mock:playwright | 5e937f2c8a210286 | probe: bot status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:46:09 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:46:09 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:46:09 | reputation | context | mock:virustotal | — | status: unknown | |
| 2026-10-12 06:46:09 | whois | primary | mock:rdap | — | status: positive | |
| 2026-10-12 06:46:09 | screenshot · datacenter view | primary | mock:playwright | 0aa5f5f63413d5f2 | phash: b2c9cd3232cdcd32 dhash: 0000100c0c100000 palette: ['#fafafa', '#f8f8f8', '#c8… | artifact |
show all 60 evidence rows from 8 scan(s)
| 2026-10-12 06:46:09 | html · datacenter view | primary | mock:playwright | 5e937f2c8a210286 | title: Welcome forms: 0 parked: False | artifact |
| 2026-10-12 06:46:09 | http | supporting | mock:playwright | 5e937f2c8a210286 | status: 200 final_url: https://shopnova-giftcard.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-12 06:46:09 | dns | supporting | mock:local_dns | — | status: positive | |
| 2026-10-12 06:46:04 | favicon · residential view | primary | probe:residential | ffd6e7f7b2b08577 | mmh3: -2029202433 phash: dc966349c3693c96 probe: residential +1 | artifact |
| 2026-10-12 06:46:04 | screenshot · residential view | primary | probe:residential | b3ad05659eee391c | phash: be37c1cd4c483137 dhash: f04f0c396d5c55ab palette: ['#f5f4fb', '#412db1', '#ff… +2 | artifact |
| 2026-10-12 06:46:04 | html · residential view | primary | probe:residential | 6004976ec5ea76af | title: ShopNova — Sign in forms: 1 parked: False +2 | artifact |
| 2026-10-12 06:46:04 | http · residential view | primary | mock:playwright | 6004976ec5ea76af | probe: residential status: 200 content_sha256: 6004976ec5ea76af96ce7ba48c9… +3 | |
| 2026-10-12 06:46:04 | http · referer view | supporting | mock:playwright | 5e937f2c8a210286 | probe: referer status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:46:04 | http · param view | supporting | mock:playwright | 5e937f2c8a210286 | probe: param status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:46:04 | http · bot view | supporting | mock:playwright | 5e937f2c8a210286 | probe: bot status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:46:04 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:46:04 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:46:04 | reputation | context | mock:virustotal | — | status: unknown | |
| 2026-10-12 06:46:04 | whois | primary | mock:rdap | — | status: positive | |
| 2026-10-12 06:46:04 | screenshot · datacenter view | primary | mock:playwright | 0aa5f5f63413d5f2 | phash: b2c9cd3232cdcd32 dhash: 0000100c0c100000 palette: ['#fafafa', '#f8f8f8', '#c8… | artifact |
| 2026-10-12 06:46:04 | html · datacenter view | primary | mock:playwright | 5e937f2c8a210286 | title: Welcome forms: 0 parked: False | artifact |
| 2026-10-12 06:46:04 | http | supporting | mock:playwright | 5e937f2c8a210286 | status: 200 final_url: https://shopnova-giftcard.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-12 06:46:04 | dns | supporting | mock:local_dns | — | status: positive | |
| 2026-10-12 06:41:56 | favicon · residential view | primary | probe:residential | ffd6e7f7b2b08577 | mmh3: -2029202433 phash: dc966349c3693c96 probe: residential +1 | artifact |
| 2026-10-12 06:41:56 | screenshot · residential view | primary | probe:residential | b3ad05659eee391c | phash: be37c1cd4c483137 dhash: f04f0c396d5c55ab palette: ['#f5f4fb', '#412db1', '#ff… +2 | artifact |
| 2026-10-12 06:41:56 | html · residential view | primary | probe:residential | 6004976ec5ea76af | title: ShopNova — Sign in forms: 1 parked: False +2 | artifact |
| 2026-10-12 06:41:56 | http · residential view | primary | mock:playwright | 6004976ec5ea76af | probe: residential status: 200 content_sha256: 6004976ec5ea76af96ce7ba48c9… +3 | |
| 2026-10-12 06:41:56 | http · referer view | supporting | mock:playwright | 5e937f2c8a210286 | probe: referer status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:41:56 | http · param view | supporting | mock:playwright | 5e937f2c8a210286 | probe: param status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:41:56 | http · bot view | supporting | mock:playwright | 5e937f2c8a210286 | probe: bot status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:41:56 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:41:56 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:41:56 | reputation | context | mock:virustotal | — | status: unknown | |
| 2026-10-12 06:41:56 | whois | primary | mock:rdap | — | status: positive | |
| 2026-10-12 06:41:56 | screenshot · datacenter view | primary | mock:playwright | 0aa5f5f63413d5f2 | phash: b2c9cd3232cdcd32 dhash: 0000100c0c100000 palette: ['#fafafa', '#f8f8f8', '#c8… | artifact |
| 2026-10-12 06:41:56 | html · datacenter view | primary | mock:playwright | 5e937f2c8a210286 | title: Welcome forms: 0 parked: False | artifact |
| 2026-10-12 06:41:56 | http | supporting | mock:playwright | 5e937f2c8a210286 | status: 200 final_url: https://shopnova-giftcard.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-12 06:41:56 | dns | supporting | mock:local_dns | — | status: positive | |
| 2026-10-12 06:41:51 | favicon · residential view | primary | probe:residential | ffd6e7f7b2b08577 | mmh3: -2029202433 phash: dc966349c3693c96 probe: residential +1 | artifact |
| 2026-10-12 06:41:51 | screenshot · residential view | primary | probe:residential | b3ad05659eee391c | phash: be37c1cd4c483137 dhash: f04f0c396d5c55ab palette: ['#f5f4fb', '#412db1', '#ff… +2 | artifact |
| 2026-10-12 06:41:51 | html · residential view | primary | probe:residential | 6004976ec5ea76af | title: ShopNova — Sign in forms: 1 parked: False +2 | artifact |
| 2026-10-12 06:41:51 | http · residential view | primary | mock:playwright | 6004976ec5ea76af | probe: residential status: 200 content_sha256: 6004976ec5ea76af96ce7ba48c9… +3 | |
| 2026-10-12 06:41:51 | http · referer view | supporting | mock:playwright | 5e937f2c8a210286 | probe: referer status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:41:51 | http · param view | supporting | mock:playwright | 5e937f2c8a210286 | probe: param status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:41:51 | http · bot view | supporting | mock:playwright | 5e937f2c8a210286 | probe: bot status: 200 content_sha256: 5e937f2c8a2102869f2d2bfdccf… +3 | |
| 2026-10-12 06:41:51 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:41:51 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:41:51 | reputation | context | mock:virustotal | — | status: unknown | |
| 2026-10-12 06:41:51 | whois | primary | mock:rdap | — | status: positive | |
| 2026-10-12 06:41:51 | screenshot · datacenter view | primary | mock:playwright | 0aa5f5f63413d5f2 | phash: b2c9cd3232cdcd32 dhash: 0000100c0c100000 palette: ['#fafafa', '#f8f8f8', '#c8… | artifact |
| 2026-10-12 06:41:51 | html · datacenter view | primary | mock:playwright | 5e937f2c8a210286 | title: Welcome forms: 0 parked: False | artifact |
| 2026-10-12 06:41:51 | http | supporting | mock:playwright | 5e937f2c8a210286 | status: 200 final_url: https://shopnova-giftcard.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-12 06:41:51 | dns | supporting | mock:local_dns | — | status: positive |
Advisory opinions · shown for context, never part of the score ⚙ AI advisory · JSON schema
AI · mock:openai phishing impersonating ShopNova · 85% — credential form; lure language; page presents itself as ShopNova
classifier · ml-5edcdd68-19 P(phishing) = 91% (cross-validated accuracy 94%)