risk ?

high likely counterfeit seller confirmed · likely fake brand ShopNova

kicksmart-il.co.il

Registered 50 days ago. A .il shop advertising ShopNova products on Facebook / Instagram (page “KickSmart”) at 379 ILS per item — 47% of the official 799 ILS. The company it names is dissolved (the Israeli Registrar of Companies (recorded)). Google knows nothing about the business outside the shop itself.

found by Facebook / Instagram ads confidence ?80% domain name · https://kicksmart-il.co.il/ hosted

198.51.100.45 registrar Mock Registrar LLC

THREAT INTEL · what public blocklists say about this site — each card opens the lookup

VirusTotal↗

not in VirusTotal yet (unknown ≠ clean)

Google Safe Browsing↗

not on Google's list yet — browsers do not warn

Not on public blocklists yet — they lag by hours or days. BrandWatch found it first; unknown is never treated as safe.

What do I do · get it taken down

✓ Confirmed · Likely counterfeit seller · 2026-10-14 09:52

by admin

change the conclusion

Attack infrastructure: mapped → open the map

domain timeline evidence packages:json · 2026-10-14 09:52 html · 2026-10-14 09:52

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

No notes yet.

Conclusion · how sure are we that it sells fakes? — every letter and report claims only this

1 · Suspicious shopsigns that justify a closer look — not proof that the goods are fake

2 · Likely counterfeit sellerindependent evidence about the goods and about the seller point to counterfeits the analyst’s conclusion

3 · Confirmed counterfeitdirect proof: a test purchase, the brand's inspection of the product, or a platform's confirmation

BrandWatch reads “Likely counterfeit seller” because: the price is half the official price or less · the company is not in the registry, is dissolved, or is another business · the seller is anonymous — no company details, or nothing about it on Google.

What would move it up:

for “Confirmed counterfeit”: a test purchase, the brand's inspection of the product, or a platform's confirmation

Concluded by admin · 2026-10-14 09:52

Shop checks · is this a real seller of ShopNova products? · separate from the phishing score (shop-v2-d92668ce)

✓

About ShopNova

the page names “shopnova”

Company dissolved

קיקסמארט בע"מ · the Israeli Registrar of Companies (recorded)

open the registry ↗

✓

Policy pages linked

privacy, terms, returns

✓

E-mail on the shop’s own domain

info@kicksmart-il.co.il

✓

Company details on the page

קיקסמארט בע"מ 515551232

Half the official price or less

379 ILS per item (⁨₪379⁩) — 47% of the official 799 ILS (ShopNova Runner)

New domain

domain registered 50 day(s) ago

No footprint on Google

Google finds nothing about “קיקסמארט בע"מ” outside the shop itself

AI: is this shop legitimate? · advisory, never part of the score

LIKELY SCAM

90% · mock:openai · likely sells replicas

domain registered 50 day(s) ago
379 ILS per item (⁨₪379⁩) — 47% of the official 799 ILS (ShopNova Runner)
קיקסמארט בע"מ is dissolved in the Israeli Registrar of Companies (recorded)
Google finds nothing about “קיקסמארט בע"מ” outside the shop itself

reviews mention fake or replica products

Where it was found

Country IL · page language he · built on Shopify

1 Meta ad(s) send buyers here — see Report to Meta below.

Report to Meta · the ads and the pages that send buyers to this shop

Meta's own “Report ad” and “Report Page” flows work for anyone with a Facebook account. BrandWatch prepares the links and the text; a person files the report. Draft a takedown to keep track of what was reported.

KickSmart 1 adalso on Instagram

Open the page ↗

Report the page: open it → “…” → Report Page → Scam / fraud or Pretending to be a business.

“ShopNova Runner ב-₪379 — רק השבוע”

IL · running since 2026-10-05 · facebook, instagram · ad 1007212087652391

Report this ad ↗

Report an ad: open it in the Ad Library → “…” → Report ad → Scam or fraud (or Intellectual property → Counterfeit, if you hold the trademark).

Text to paste into the report

This ad / page sends buyers to https://kicksmart-il.co.il/, a shop that is likely selling counterfeit ShopNova products. It is not an authorised ShopNova retailer.
Registered 50 days ago. A .il shop advertising ShopNova products on Facebook / Instagram (page “KickSmart”) at 379 ILS per item — 47% of the official 799 ILS. The company it names is dissolved (the Israeli Registrar of Companies (recorded)). Google knows nothing about the business outside the shop itself.
Ad: https://www.facebook.com/ads/library/?id=1007212087652391 — page “KickSmart”

FOR THE TRADEMARK OWNER

Facebook — Trademark report form ↗for the trademark owner; has a dedicated option for content offering counterfeit goods

Instagram / Threads — Counterfeit report form ↗selling or promoting counterfeit goods on Instagram or Threads

Instagram — Trademark report form ↗use of the brand name or logo on Instagram without permission

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

Signal	Group	Points	Evidence
company dissolved shop_company_dissolved	Seller	+20	קיקסמארט בע"מ is dissolved in the Israeli Registrar of Companies (recorded)
half the official price or less shop_price_far_below_official	Offer	+20	379 ILS per item (⁨₪379⁩) — 47% of the official 799 ILS (ShopNova Runner)
new domain shop_new_domain	Freshness	+12	domain registered 50 day(s) ago
no footprint on Google shop_no_web_presence	Seller	+10	Google finds nothing about “קיקסמארט בע"מ” outside the shop itself

How the score adds up

⚙ deterministic · versioned Raw 53 of 100 → normalised to 53 / 100. Thresholds: Medium 25 · High 50 · Critical 75 · scoring shop-v2-d92668ce
open the arithmetic ↗ — this site's section of the scan trace

Group caps ? · stop correlated evidence from double counting

Freshness

12 → 8

Offer

20 / 22

Seller

30 → 25

Confidence ? · 80%

Breadth (3 independent groups)	+60
Hard confirmers	+0
Evidence completeness	+20
Provider agreement	+0
Unavailable evidence	0
Single weak signal	0

Suspect vs. official similarity 50%

kicksmart-il.co.il

the real ShopNova ?

VirusTotal · security vendors

0 of 90 engines flag this domain

malicious 0 · suspicious 0 · community reputation 0

Server reputation · AbuseIPDB

198.51.100.45 0/ 1000 report(s)

25 or more = several defenders reported abuse from this server.

JARM

bef21f05f46411f7f3574132e4f983c44477cf88aa87f742ff89b283203fb4

Engines flagged first

Engine	Category	Result	Method
BitDefender	harmless	clean	blacklist
CRDF	harmless	clean	blacklist
ESET	harmless	clean	blacklist
Fortinet	harmless	clean	blacklist
Google Safebrowsing	harmless	clean	blacklist
Kaspersky	harmless	clean	blacklist
Netcraft	harmless	clean	blacklist
OpenPhish	harmless	clean	blacklist
Phishtank	harmless	clean	blacklist
Quttera	harmless	clean	blacklist
Sophos	harmless	clean	blacklist
Webroot	harmless	clean	blacklist

Look it up elsewhere

Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.

VirusTotal domain ↗VirusTotal relations ↗urlscan search ↗URLhaus ↗crt.sh ↗Google Safe Browsing ↗Wayback Machine ↗Censys ↗VirusTotal URL ↗VirusTotal IP ↗Shodan ↗AbuseIPDB ↗Censys host ↗

Jump to Registration WHOIS history DNS records Certificate

Registration data (RDAP)

Name: kicksmart-il.co.il
registration: 2026-08-25
Status: —
DNSSEC: —

Registrar & abuse contact

Registrar: Mock Registrar LLC
Abuse email: —
registrant org: REDACTED FOR PRIVACY

Nameservers

—

Current WHOIS record (VirusTotal)

Domain Name: KICKSMART-IL.CO.IL Registrar: Mock Registrar LLC Registrar Abuse Contact Email: abuse@mock-registrar.example Creation Date: 2026-08-25T00:00:00Z Name Server: NS1.MOCK-DNS.EXAMPLE Registrant Country: US

WHOIS history · every WHOIS snapshot WhoisXML has recorded for kicksmart-il.co.il

Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.

First registered

2026-08-25

Mock Registrar LLC

Snapshots

2026-08-26 → 2026-08-26

Owners seen

0 visible

0 owner change(s)

Registrars

0 transfer(s) · Mock Registrar LLC

Owner details now

Hidden

privacy since registration

TIMELINE

2026-08-25
Registered with privacy on
registrant shown as 'REDACTED FOR PRIVACY' · via Mock Registrar LLC · first WHOIS snapshot 2026-08-26

SNAPSHOTS · CHANGED FIELDS MARKED

Seen	Registrar	Registrant	Created · expires
2026-08-26	Mock Registrar LLC	hidden · REDACTED FOR PRIVACY	2026-08-25 · 2027-08-25
raw WHOIS · 2026-08-26 Domain Name: KICKSMART-IL.CO.IL Registrar: Mock Registrar LLC Creation Date: 2026-08-25T00:00:00Z Updated Date: 2026-08-26T00:00:00Z Registry Expiry Date: 2027-08-25T00:00:00Z Registrant Organization: REDACTED FOR PRIVACY Registrant Name: Registrant Email: Name Server: NS1.MOCK-DNS.EXAMPLE Name Server: NS2.MOCK-DNS.EXAMPLE

Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .

DNS records source: VirusTotal

A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).

Type	TTL	Value
A	300	198.51.100.45
AAAA	300	2001:db8::7df4
NS	21600	ns1.mock-dns.example
NS	21600	ns2.mock-dns.example
MX	3600	mail.kicksmart-il.co.il prio 10
SOA	1800	ns1.mock-dns.example rname hostmaster.kicksmart-il.co.il · serial 2026100801

HTTPS certificate from VirusTotal

Common name: kicksmart-il.co.il
Issuer: C=US O=Mock Trust Services CN=MT1
Valid: 2026-09-20 00:00:00 → 2026-12-19 00:00:00
32% of the validity period elapsed
Alt names (2): kicksmart-il.co.il www.kicksmart-il.co.il
SHA-256: 4f8b0455328cdd045f0a73bc678fc6d1e588cf50670ef4bb45b70c234e38f46c · crt.sh ↗

serial, signature, key, TLS and the full certificate

Subject: CN=kicksmart-il.co.il
Serial: 8bb4f23f
Signature: sha256ECDSA
Public key: EC secp256r1
SHA-1: 042f6f60d628d78f6c30a36ceb6fcf17da172223

{ "cert_signature": { "signature_algorithm": "sha256ECDSA" }, "extensions": { "subject_alternative_name": [ "kicksmart-il.co.il", "www.kicksmart-il.co.il" ] }, "issuer": { "C": "US", "CN": "MT1", "O": "Mock Trust Services" }, "public_key": { "algorithm": "EC", "ec": { "oid": "secp256r1" } }, "serial_number": "8bb4f23f", "subject": { "CN": "kicksmart-il.co.il" }, "thumbprint": "042f6f60d628d78f6c30a36ceb6fcf17da172223", "thumbprint_sha256": "4f8b0455328cdd045f0a73bc678fc6d1e588cf50670ef4bb45b70c234e38f46c", "validity": { "not_after": "2026-12-19 00:00:00", "not_before": "2026-09-20 00:00:00" }, "version": "V3" }

Jump to Servers urlscan & similar sites Passive DNS & relations

198.51.100.45

United States · Los Angeles · AS64585 · Mock Hosting LLC · 198.51.100.0/24 · RIPE NCC

0 of 94 engines flag this IP · 5 sites hosted, 2 flagged · 0 communicating files

VirusTotal IP ↗Shodan ↗AbuseIPDB ↗Censys host ↗ open server page →

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

0/ 100

No reports in the last 90 days

Data Center/Web Hosting/Transit · Mock Hosting LLC

A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

Last resolved	Detections	Domain
2026-10-13	5/ 95	kicksmart-il.co.il	VT ↗ · urlscan ↗
2026-10-07	5/ 95	wallet-sync-0045.online	VT ↗ · urlscan ↗
2026-10-11	0/ 90	secure-login-0045.top	VT ↗ · urlscan ↗
2026-10-05	0/ 90	support-desk-0045.site	VT ↗ · urlscan ↗
2026-10-09	0/ 90	verify-account-0045.xyz	VT ↗ · urlscan ↗

COMMUNICATING FILES not fetched yet

IP WHOIS record

inetnum: 198.51.100.0 - 198.51.100.255 org-name: Mock Hosting LLC abuse-mailbox: abuse@mock.example

engine verdicts for this IP (12)

Engine	Category	Result
BitDefender	harmless	clean
CRDF	harmless	clean
ESET	harmless	clean
Fortinet	harmless	clean
Google Safebrowsing	harmless	clean
Kaspersky	harmless	clean
Netcraft	harmless	clean
OpenPhish	harmless	clean
Phishtank	harmless	clean
Quttera	harmless	clean
Sophos	harmless	clean
Webroot	harmless	clean

urlscan.io scan

not flagged by urlscan

Netherlands 203.0.113.66AS64512 BulletproofHost BV server nginx 23 requests · 2 domains · 1 IPs · 1 countries scanned 2026-10-14 09:52

title: kicksmart-il.co.il - Sign in

full urlscan result ↗all scans of kicksmart-il.co.il ↗

domains contacted by the page (2)

kicksmart-il.co.il · cdn.mock-static.example

Similar sites 30

Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.

Same page (identical document hash) 4hash:0a48946c4facf6662d9d3b9120c99cdbf7de66a1aa5e17e7f224b81d7813a553

the same HTML served elsewhere — the same phishing kit

Seen	Verdict	Domain		Title
2026-09-16	—	shopn0va.com	urlscan ↗ · VT ↗	shopn0va.com - Sign in
2026-09-15	—	shopnova-login.com	urlscan ↗ · VT ↗	shopnova-login.com - Sign in
2026-09-14	—	secure-shopnova.com	urlscan ↗ · VT ↗	secure-shopnova.com - Sign in
2026-09-08	—	shopnova.co	urlscan ↗ · VT ↗	shopnova.co - Sign in

Same server 0page.ip:203.0.113.66

other pages scanned on the same IP

none

Same brand name 26page.domain:shopnova

domains containing the brand name

Seen	Verdict	Domain		Title
2026-10-14	—	shopnova-partners.com	urlscan ↗ · VT ↗	shopnova-partners.com - Sign in
2026-10-13	—	shopnova-blog.net	urlscan ↗ · VT ↗	shopnova-blog.net - Sign in
2026-10-12	—	shopnovafans.com	urlscan ↗ · VT ↗	shopnovafans.com - Sign in
2026-10-11	—	shopnova-reviews.com	urlscan ↗ · VT ↗	shopnova-reviews.com - Sign in
2026-10-10	—	shopnova-careers.com	urlscan ↗ · VT ↗	shopnova-careers.com - Sign in
2026-10-09	—	shopnova-deals.com	urlscan ↗ · VT ↗	shopnova-deals.com - Sign in
2026-10-08	—	shopnova-status.com	urlscan ↗ · VT ↗	shopnova-status.com - Sign in
2026-10-07	—	shopnova-community.org	urlscan ↗ · VT ↗	shopnova-community.org - Sign in
2026-10-06	—	shopnova-press.com	urlscan ↗ · VT ↗	shopnova-press.com - Sign in
2026-10-05	—	shopnova-events.com	urlscan ↗ · VT ↗	shopnova-events.com - Sign in
2026-09-24	—	shopnova.com	urlscan ↗ · VT ↗	shopnova.com - Sign in
2026-09-23	—	www.shopnova.com	urlscan ↗ · VT ↗	www.shopnova.com - Sign in
2026-09-22	—	shopnova.co.il	urlscan ↗ · VT ↗	shopnova.co.il - Sign in
2026-09-13	—	shopnova-verify.com	urlscan ↗ · VT ↗	shopnova-verify.com - Sign in
2026-09-10	—	shopnova-account.net	urlscan ↗ · VT ↗	shopnova-account.net - Sign in
2026-09-09	—	shopnova-support-center.com	urlscan ↗ · VT ↗	shopnova-support-center.com - Sign in
2026-09-06	—	shopnova-giftcard.com	urlscan ↗ · VT ↗	shopnova-giftcard.com - Sign in
2026-09-05	—	shopnova-refund.net	urlscan ↗ · VT ↗	shopnova-refund.net - Sign in
2026-09-04	—	shopnova-verification.com	urlscan ↗ · VT ↗	shopnova-verification.com - Sign in
2026-09-03	—	shopnova--sneakers.com	urlscan ↗ · VT ↗	shopnova--sneakers.com - Sign in
2026-09-02	—	shopnova-eu.com	urlscan ↗ · VT ↗	shopnova-eu.com - Sign in
2026-09-01	—	shopnova-id-check.com	urlscan ↗ · VT ↗	shopnova-id-check.com - Sign in
2026-08-20	—	shopnova-support.com	urlscan ↗ · VT ↗	shopnova-support.com - Sign in
2026-08-19	—	shopnova-review.com	urlscan ↗ · VT ↗	shopnova-review.com - Sign in
2026-08-18	—	shopnova-coupons.com	urlscan ↗ · VT ↗	shopnova-coupons.com - Sign in

Passive DNS replication 1

Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.

Date resolved	Detections (IP)	IP
2026-09-27	3/ 92	198.51.100.45

Subdomains 3

Host	Detections
login.kicksmart-il.co.il	2/ 92
mail.kicksmart-il.co.il	0/ 90
www.kicksmart-il.co.il	0/ 90

Communicating files 0 not fetched yet

Malware samples that contacted this domain while being analysed.

Historical WHOIS · VirusTotal 1

2026-09-14 · Mock Registrar LLC

Registrant Organization: REDACTED FOR PRIVACY
Registrant Country: US
Name Server: NS1.MOCK-DNS.EXAMPLE

Historical certificates 0 VT · 1 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Not before	Names	Issuer
2026-09-30	kicksmart-il.co.il, www.kicksmart-il.co.il	C=US, O=Let's Encrypt, CN=R3

Observation timeline

2026-10-12 06:41:47 · HTTP 200 · state new · datacenter · content changed · 709ae58a2d6d · screenshot
2026-10-12 06:46:01 · HTTP 200 · state flagged · datacenter · 709ae58a2d6d · screenshot

first seen 2026-10-12 06:41 · scans 2 · next 2026-10-12 12:46 · candidate state flagged · WHOIS history →

Score history

When	Score	Severity	Confidence	Version
2026-10-12 06:41:47	53	high	80%	shop-v2-d92668ce
2026-10-12 06:46:01 current	53	high	80%	shop-v2-d92668ce

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.

Observed (UTC)	Type	Role	Source	SHA-256	Details
2026-10-12 06:46:01	reputation	contradicting	mock:safebrowsing	—	status: negative
2026-10-12 06:46:01	reputation	context	mock:urlhaus	—	status: unknown
2026-10-12 06:46:01	reputation	context	mock:virustotal	—	status: unknown
2026-10-12 06:46:01	whois	primary	mock:rdap	—	status: positive
2026-10-12 06:46:01	favicon	context	mock:playwright	afa497b454177b44	mmh3: 1920833077 phash: decb035af470fc20	artifact
2026-10-12 06:46:01	screenshot · datacenter view	context	mock:playwright	17620498ed282067	phash: a04277035e7d2d7c dhash: cd8d92a5a5d31e3c palette: ['#323a50', '#9e4a82', '#98…	artifact
2026-10-12 06:46:01	html · datacenter view	primary	mock:playwright	709ae58a2d6d6b55	title: קיקסמארט — ShopNova Runner forms: 0 parked: False	artifact
2026-10-12 06:46:01	http	supporting	mock:playwright	709ae58a2d6d6b55	status: 200 final_url: https://kicksmart-il.co.il/ content_type: text/html; charset=utf-8
2026-10-12 06:46:01	dns	supporting	mock:local_dns	—	status: positive
2026-10-12 06:41:47	reputation	contradicting	mock:safebrowsing	—	status: negative
2026-10-12 06:41:47	reputation	context	mock:urlhaus	—	status: unknown
2026-10-12 06:41:47	reputation	context	mock:virustotal	—	status: unknown

show all 18 evidence rows from 2 scan(s)

2026-10-12 06:41:47	whois	primary	mock:rdap	—	status: positive
2026-10-12 06:41:47	favicon	context	mock:playwright	afa497b454177b44	mmh3: 1920833077 phash: decb035af470fc20	artifact
2026-10-12 06:41:47	screenshot · datacenter view	context	mock:playwright	17620498ed282067	phash: a04277035e7d2d7c dhash: cd8d92a5a5d31e3c palette: ['#323a50', '#9e4a82', '#98…	artifact
2026-10-12 06:41:47	html · datacenter view	primary	mock:playwright	709ae58a2d6d6b55	title: קיקסמארט — ShopNova Runner forms: 0 parked: False	artifact
2026-10-12 06:41:47	http	supporting	mock:playwright	709ae58a2d6d6b55	status: 200 final_url: https://kicksmart-il.co.il/ content_type: text/html; charset=utf-8
2026-10-12 06:41:47	dns	supporting	mock:local_dns	—	status: positive

kicksmart-il.co.il

What do I do · get it taken down

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

Conclusion · how sure are we that it sells fakes? — every letter and report claims only this

Shop checks · is this a real seller of ShopNova products? · separate from the phishing score (shop-v2-d92668ce)

AI: is this shop legitimate? · advisory, never part of the score

Where it was found

Report to Meta · the ads and the pages that send buyers to this shop

KickSmart 1 adalso on Instagram

FOR THE TRADEMARK OWNER

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

How the score adds up

Group caps ? · stop correlated evidence from double counting

Confidence ? · 80%

Suspect vs. official similarity 50%

VirusTotal · security vendors

Server reputation · AbuseIPDB

Categories

JARM

Engines flagged first

Look it up elsewhere

Registration data (RDAP)

Registrar & abuse contact

Nameservers

WHOIS history · every WHOIS snapshot WhoisXML has recorded for kicksmart-il.co.il

First registered

Snapshots

Owners seen

Registrars

Owner details now

TIMELINE

SNAPSHOTS · CHANGED FIELDS MARKED

DNS records source: VirusTotal

HTTPS certificate from VirusTotal

198.51.100.45

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

COMMUNICATING FILES not fetched yet

urlscan.io scan

Similar sites 30

Same page (identical document hash) 4hash:0a48946c4facf6662d9d3b9120c99cdbf7de66a1aa5e17e7f224b81d7813a553

Same server 0page.ip:203.0.113.66

Same brand name 26page.domain:*shopnova*

Passive DNS replication 1

Subdomains 3

Communicating files 0 not fetched yet

Historical WHOIS · VirusTotal 1

Historical certificates 0 VT · 1 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Observation timeline

Score history

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Same brand name 26page.domain:shopnova