03-9817777
ChatGPT gives 03-9817777 as ShopNova's phone. No page of ShopNova publishes it; shopnova-support-center.com does — callers reach whoever runs that page.
What do I do · review the evidence below, then give a verdict
Only a page that is not ShopNova’s publishes this contact — confirm, then take that page down (its own finding) and report the answer to the AI vendor (AI answer tab).
Notes · for you and the next analyst — kept with the finding, never edited, also in Activity
No notes yet.
- ChatGPT gave the phone 03-9817777 — it is on none of ShopNova's pages
- 03-9817777 is published on shopnova-support-center.com — not a site of ShopNova
- shopnova-support-center.com carries the brand's name: a look-alike publishes the number
- shopnova-support-center.com (a phishing site BrandWatch confirmed)
The contacts ShopNova publishes on its own site: 03-6000000 · *6700 · *6711 · support@shopnova.com · +972506000000 — all of them, with their pages
What the assistants said
- source: ShopNova Support Center — 24/7 help — https://shopnova-support-center.com/
- source: Contact us — ShopNova — https://shopnova.com/contact
Asked for the proof
- source: ShopNova Support Center — 24/7 help — https://shopnova-support-center.com/
What the pages really say · BrandWatch opened every page the assistants cited — their word is never taken
| Page | The brand's? | Carries 03-9817777? | |
|---|---|---|---|
| https://shopnova-support-center.com/ | no | yes | carries the brand's namea phishing site BrandWatch confirmed |
| https://shopnova.com/contact | ✓ official | no |
What to do
- Take the page that publishes it down: it was sent to the website checks of this scan — see its own finding in Findings.
- Report the answer to the assistant: in ChatGPT, ask the same question and use the answer's thumbs-down / report button with the text below. Nothing is sent from BrandWatch.
- Make the real contacts easy for assistants to read: one contact page, the numbers as text (not only in images), and schema.org ContactPoint markup on it.
- If 03-9817777 is really yours, press This is our contact above.
Explain Finding — why it was flagged · every signal, its points and the evidence behind it
| Signal | Group | Points | Evidence |
|---|---|---|---|
| not on the brand's site ai_contact_not_on_site | Identity | +40 | ChatGPT gave the phone 03-9817777 — it is on none of ShopNova's pages |
| a known phishing site ai_known_suspect | Reputation | +40 | shopnova-support-center.com (a phishing site BrandWatch confirmed) |
| published by a look-alike ai_offsite_lookalike | Infrastructure | +30 | shopnova-support-center.com carries the brand's name: a look-alike publishes the number |
| published off the brand's site ai_offsite_page | Infrastructure | +20 | 03-9817777 is published on shopnova-support-center.com — not a site of ShopNova |
How the score adds up
⚙ deterministic · versioned Raw 100 of 100 → normalised to 100 / 100.
Thresholds: Medium 25 · High 50 · Critical 75 · scoring aianswer-v1-e26ad54f
open the arithmetic ↗ — this site's section of the scan trace
Group caps ? · stop correlated evidence from double counting
Confidence ? · 85%
| Breadth (3 independent groups) | +75 |
| Hard confirmers | +0 |
| Evidence completeness | +10 |
| Provider agreement | +0 |
| Unavailable evidence | 0 |
| Single weak signal | 0 |
Suspect vs. official
No screenshot captured (unavailable — not "clean").
Not investigated yet
VirusTotal's verdict from 70+ security vendors, every engine's result and category, and the AbuseIPDB abuse score of each server hosting the site. Google Safe Browsing and URLhaus are already in the header — the scan checks them.
Press Run investigation above: one pass over the APIs, cached for 24 hours.
Look it up elsewhere
Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.
Not investigated yet
RDAP registration and the registrar's abuse contact, the full WHOIS history (every owner, transfer and privacy change — and owner details that were hidden later), DNS records and the HTTPS certificate.
Press Run investigation above: one pass over the APIs, cached for 24 hours.
Not investigated yet
Every server hosting the site with its AbuseIPDB score and every other site on it, the urlscan.io scan with pages that share the same kit, passive DNS, subdomains, historical certificates and malware that contacted the domain.
Press Run investigation above: one pass over the APIs, cached for 24 hours.
Observation timeline
- 2026-10-18 07:29:25 · HTTP — · state new · datacenter · 4b5ec95b95d8
- 2026-10-18 07:32:12 · HTTP — · state flagged · datacenter · content changed · f70180ce7aff
first seen 2026-10-18 07:29 · scans 2 · next — · candidate state flagged · WHOIS history →
Score history
| When | Score | Severity | Confidence | Version |
|---|---|---|---|---|
| 2026-10-18 07:29:25 | 100 | critical | 85% | aianswer-v1-e26ad54f |
| 2026-10-18 07:32:12 current | 100 | critical | 85% | aianswer-v1-e26ad54f |
Evidence · chain of custody ? ⚙ immutable · DB-enforced
Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.
| Observed (UTC) | Type | Role | Source | SHA-256 | Details | |
|---|---|---|---|---|---|---|
| 2026-10-18 07:32:12 | http | supporting | searchapi:ai_answers | f70180ce7affefaa | status: positive kind: phone value: +97239817777 +1 | artifact |
| 2026-10-18 07:29:25 | http | supporting | searchapi:ai_answers | 4b5ec95b95d8c616 | status: positive kind: phone value: +97239817777 +1 | artifact |