onestyle-shopping.com
Registered 21 days ago. A .com shop in Hebrew selling ShopNova products at 350 ILS per item — 44% of the official 799 ILS. Its only e-mail is Gmail (onestyle.store@gmail.com), it has no privacy policy, terms or returns page and company number 516728391 does not exist in the Israeli Registrar of Companies (recorded). Search results about it mention scams or replica products.
What do I do · get it taken down
change the conclusion
Notes · for you and the next analyst — kept with the finding, never edited, also in Activity
No notes yet.
Conclusion · how sure are we that it sells fakes? — every letter and report claims only this
BrandWatch reads “Likely counterfeit seller” because: the price is half the official price or less · reviews say the goods are fake · reviews report a scam or orders that never arrived · the company is not in the registry, is dissolved, or is another business · the seller is anonymous — no company details, or nothing about it on Google.
What would move it up:
- for “Confirmed counterfeit”: a test purchase, the brand's inspection of the product, or a platform's confirmation
Concluded by admin · 2026-10-14 09:50
Shop checks · is this a real seller of ShopNova products? · separate from the phishing score (shop-v2-d92668ce)
search results about the shop (1)
- onestyle-shopping.com — קיבלתי רפליקה — הזמנתי 2 זוגות וקיבלתי נעליים מזויפות. עוקץ, אל תזמינו.
AI: is this shop legitimate? · advisory, never part of the score
- no privacy policy, terms or returns page linked from the shop's page
- the only contact e-mail is a free mailbox (onestyle.store@gmail.com)
- contact is WhatsApp / phone only — no e-mail on the shop's own domain
- multi-buy offer: “אול עליו שוב ושוב 👀 2 זוגות ShopNova Runner ב-699 ₪ — בוחרים”
- a .com site written in he — a local shop without the country's domain ending
- domain registered 21 day(s) ago
reviews mention fake or replica products
Where it was found
Country IL · page language he · built on Shopify
Explain Finding — why it was flagged · every signal, its points and the evidence behind it
| Signal | Group | Points | Evidence |
|---|---|---|---|
| company number not in the registry shop_company_not_in_registry | Seller | +25 | company number 516728391 (ח.פ.) does not exist in the Israeli Registrar of Companies (recorded) |
| half the official price or less shop_price_far_below_official | Offer | +20 | 350 ILS per item (אול עליו שוב ושוב 👀 2 זוגות ShopNova Runner ב-699 ) — 44% of the official 799 ILS (ShopNova Runner) |
| reviews say scam / replica shop_reviews_warn | Reputation | +15 | a search result about the shop mentions “עוקץ”: onestyle-shopping.com — קיבלתי רפליקה |
| Gmail-type contact only shop_free_email_only | Contact & policies | +12 | the only contact e-mail is a free mailbox (onestyle.store@gmail.com) |
| new domain shop_new_domain | Freshness | +12 | domain registered 21 day(s) ago |
| no privacy / terms / returns shop_no_policy_pages | Contact & policies | +12 | no privacy policy, terms or returns page linked from the shop's page |
| no footprint on Google shop_no_web_presence | Seller | +10 | Google finds nothing about “516728391” outside the shop itself |
| WhatsApp / phone only shop_chat_or_phone_only | Contact & policies | +6 | contact is WhatsApp / phone only — no e-mail on the shop's own domain |
show all 10 signals
| multi-buy offer shop_multibuy_bait | Offer | +6 | multi-buy offer: “אול עליו שוב ושוב 👀 2 זוגות ShopNova Runner ב-699 ₪ — בוחרים” |
| local language, generic domain shop_tld_language_mismatch | Seller | +6 | a .com site written in he — a local shop without the country's domain ending |
How the score adds up
⚙ deterministic · versioned Raw 85 of 100 → normalised to 85 / 100.
Thresholds: Medium 25 · High 50 · Critical 75 · scoring shop-v2-d92668ce
open the arithmetic ↗ — this site's section of the scan trace
Group caps ? · stop correlated evidence from double counting
Confidence ? · 90%
| Breadth (5 independent groups) | +70 |
| Hard confirmers | +0 |
| Evidence completeness | +20 |
| Provider agreement | +0 |
| Unavailable evidence | 0 |
| Single weak signal | 0 |
Suspect vs. official similarity 53%


VirusTotal · security vendors
Server reputation · AbuseIPDB
Categories
JARM
Engines flagged first
| Engine | Category | Result | Method |
|---|---|---|---|
| BitDefender | harmless | clean | blacklist |
| CRDF | harmless | clean | blacklist |
| ESET | harmless | clean | blacklist |
| Fortinet | harmless | clean | blacklist |
| Google Safebrowsing | harmless | clean | blacklist |
| Kaspersky | harmless | clean | blacklist |
| Netcraft | harmless | clean | blacklist |
| OpenPhish | harmless | clean | blacklist |
| Phishtank | harmless | clean | blacklist |
| Quttera | harmless | clean | blacklist |
| Sophos | harmless | clean | blacklist |
| Webroot | harmless | clean | blacklist |
Look it up elsewhere
Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.
Registration data (RDAP)
- Name
- onestyle-shopping.com
- registration
- 2026-09-23
- Status
- —
- DNSSEC
- —
Registrar & abuse contact
- Registrar
- Mock Registrar LLC
- Abuse email
- —
- registrant org
- REDACTED FOR PRIVACY
Nameservers
—Current WHOIS record (VirusTotal)
WHOIS history · every WHOIS snapshot WhoisXML has recorded for onestyle-shopping.com
Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.
First registered
Snapshots
Owners seen
Registrars
Owner details now
TIMELINE
- 2026-09-23Registered with privacy onregistrant shown as 'REDACTED FOR PRIVACY' · via Mock Registrar LLC · first WHOIS snapshot 2026-09-24
SNAPSHOTS · CHANGED FIELDS MARKED
| Seen | Registrar | Registrant | Created · expires |
|---|---|---|---|
| 2026-09-24 | Mock Registrar LLC | hidden · REDACTED FOR PRIVACY | 2026-09-23 · 2027-09-23 |
raw WHOIS · 2026-09-24Domain Name: ONESTYLE-SHOPPING.COM
Registrar: Mock Registrar LLC
Creation Date: 2026-09-23T00:00:00Z
Updated Date: 2026-09-24T00:00:00Z
Registry Expiry Date: 2027-09-23T00:00:00Z
Registrant Organization: REDACTED FOR PRIVACY
Registrant Name:
Registrant Email:
Name Server: NS1.MOCK-DNS.EXAMPLE
Name Server: NS2.MOCK-DNS.EXAMPLE | |||
Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .
DNS records source: VirusTotal
A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).
| Type | TTL | Value |
|---|---|---|
| A | 300 | 198.51.100.40 |
| AAAA | 300 | 2001:db8::e23c |
| NS | 21600 | ns1.mock-dns.example |
| NS | 21600 | ns2.mock-dns.example |
| MX | 3600 | mail.onestyle-shopping.com prio 10 |
| SOA | 1800 | ns1.mock-dns.example rname hostmaster.onestyle-shopping.com · serial 2026100801 |
HTTPS certificate from VirusTotal
- Common name
- onestyle-shopping.com
- Issuer
- C=US O=Mock Trust Services CN=MT1
- Valid
- 2026-09-20 00:00:00 → 2026-12-19 00:00:0032% of the validity period elapsed
- Alt names (2)
- onestyle-shopping.com www.onestyle-shopping.com
- SHA-256
- 8f048ae75cd2f160d70cf6f170ab47c67da7ae2cb2cb8c35e72bda8f71719b9b · crt.sh ↗
serial, signature, key, TLS and the full certificate
- Subject
- CN=onestyle-shopping.com
- Serial
- 1061d1db
- Signature
- sha256ECDSA
- Public key
- EC secp256r1
- SHA-1
- 1adf10567c16e3af1aebdd194f7bef3c0abc3291
198.51.100.40
Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days
SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)
| Last resolved | Detections | Domain | |
|---|---|---|---|
| 2026-10-13 | 5/ 95 | onestyle-shopping.com | VT ↗ · urlscan ↗ |
| 2026-10-07 | 5/ 95 | wallet-sync-0040.online | VT ↗ · urlscan ↗ |
| 2026-10-11 | 0/ 90 | secure-login-0040.top | VT ↗ · urlscan ↗ |
| 2026-10-05 | 0/ 90 | support-desk-0040.site | VT ↗ · urlscan ↗ |
| 2026-10-09 | 0/ 90 | verify-account-0040.xyz | VT ↗ · urlscan ↗ |
COMMUNICATING FILES not fetched yet
IP WHOIS record
engine verdicts for this IP (12)
| Engine | Category | Result |
|---|---|---|
| BitDefender | harmless | clean |
| CRDF | harmless | clean |
| ESET | harmless | clean |
| Fortinet | harmless | clean |
| Google Safebrowsing | harmless | clean |
| Kaspersky | harmless | clean |
| Netcraft | harmless | clean |
| OpenPhish | harmless | clean |
| Phishtank | harmless | clean |
| Quttera | harmless | clean |
| Sophos | harmless | clean |
| Webroot | harmless | clean |
urlscan.io scan
domains contacted by the page (2)
Similar sites 30
Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.
Same page (identical document hash) 4hash:fa10cb06cd1e8e2275ea93e0f0be5c99d299fd1ccd315b0dc845c9ff7e561d24
the same HTML served elsewhere — the same phishing kit
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-09-16 | — | urlscan ↗ · VT ↗ | shopn0va.com - Sign in | |
| 2026-09-15 | — | urlscan ↗ · VT ↗ | shopnova-login.com - Sign in | |
| 2026-09-14 | — | urlscan ↗ · VT ↗ | secure-shopnova.com - Sign in | |
| 2026-09-08 | — | urlscan ↗ · VT ↗ | shopnova.co - Sign in |
Same server 0page.ip:203.0.113.66
other pages scanned on the same IP
noneSame brand name 26page.domain:*shopnova*
domains containing the brand name
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-10-14 | — | urlscan ↗ · VT ↗ | shopnova-partners.com - Sign in | |
| 2026-10-13 | — | urlscan ↗ · VT ↗ | shopnova-blog.net - Sign in | |
| 2026-10-12 | — | urlscan ↗ · VT ↗ | shopnovafans.com - Sign in | |
| 2026-10-11 | — | urlscan ↗ · VT ↗ | shopnova-reviews.com - Sign in | |
| 2026-10-10 | — | urlscan ↗ · VT ↗ | shopnova-careers.com - Sign in | |
| 2026-10-09 | — | urlscan ↗ · VT ↗ | shopnova-deals.com - Sign in | |
| 2026-10-08 | — | urlscan ↗ · VT ↗ | shopnova-status.com - Sign in | |
| 2026-10-07 | — | urlscan ↗ · VT ↗ | shopnova-community.org - Sign in | |
| 2026-10-06 | — | urlscan ↗ · VT ↗ | shopnova-press.com - Sign in | |
| 2026-10-05 | — | urlscan ↗ · VT ↗ | shopnova-events.com - Sign in | |
| 2026-09-24 | — | urlscan ↗ · VT ↗ | shopnova.com - Sign in | |
| 2026-09-23 | — | urlscan ↗ · VT ↗ | www.shopnova.com - Sign in | |
| 2026-09-22 | — | urlscan ↗ · VT ↗ | shopnova.co.il - Sign in | |
| 2026-09-13 | — | urlscan ↗ · VT ↗ | shopnova-verify.com - Sign in | |
| 2026-09-10 | — | urlscan ↗ · VT ↗ | shopnova-account.net - Sign in | |
| 2026-09-09 | — | urlscan ↗ · VT ↗ | shopnova-support-center.com - Sign in | |
| 2026-09-06 | — | urlscan ↗ · VT ↗ | shopnova-giftcard.com - Sign in | |
| 2026-09-05 | — | urlscan ↗ · VT ↗ | shopnova-refund.net - Sign in | |
| 2026-09-04 | — | urlscan ↗ · VT ↗ | shopnova-verification.com - Sign in | |
| 2026-09-03 | — | urlscan ↗ · VT ↗ | shopnova--sneakers.com - Sign in | |
| 2026-09-02 | — | urlscan ↗ · VT ↗ | shopnova-eu.com - Sign in | |
| 2026-09-01 | — | urlscan ↗ · VT ↗ | shopnova-id-check.com - Sign in | |
| 2026-08-20 | — | urlscan ↗ · VT ↗ | shopnova-support.com - Sign in | |
| 2026-08-19 | — | urlscan ↗ · VT ↗ | shopnova-review.com - Sign in | |
| 2026-08-18 | — | urlscan ↗ · VT ↗ | shopnova-coupons.com - Sign in |
Passive DNS replication 1
Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.
| Date resolved | Detections (IP) | IP |
|---|---|---|
| 2026-09-27 | 3/ 92 | 198.51.100.40 |
Subdomains 3
| Host | Detections |
|---|---|
| login.onestyle-shopping.com | 2/ 92 |
| mail.onestyle-shopping.com | 0/ 90 |
| www.onestyle-shopping.com | 0/ 90 |
Communicating files 0 not fetched yet
Malware samples that contacted this domain while being analysed.
Historical WHOIS · VirusTotal 1
- Registrant Organization
- REDACTED FOR PRIVACY
- Registrant Country
- US
- Name Server
- NS1.MOCK-DNS.EXAMPLE
Historical certificates 0 VT · 2 CT not fetched yet
CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains
| Not before | Names | Issuer |
|---|---|---|
| 2026-09-30 | onestyle-shopping.com, www.onestyle-shopping.com | C=US, O=Let's Encrypt, CN=R3 |
| 2026-09-01 | mail0.onestyle-shopping.com-cdn.net | Mock CA |
Observation timeline
- 2026-10-12 06:41:46 · HTTP 200 · state new · datacenter · content changed · eaf15e9cd752 · screenshot
- 2026-10-12 06:46:00 · HTTP 200 · state flagged · datacenter · eaf15e9cd752 · screenshot
- 2026-10-18 06:29:19 · HTTP 200 · state flagged · datacenter · eaf15e9cd752 · screenshot
first seen 2026-10-12 06:41 · scans 3 · next 2026-10-18 12:29 · candidate state flagged · WHOIS history →
Score history
| When | Score | Severity | Confidence | Version |
|---|---|---|---|---|
| 2026-10-12 06:41:46 | 85 | critical | 90% | shop-v2-d92668ce |
| 2026-10-12 06:46:00 | 85 | critical | 90% | shop-v2-d92668ce |
| 2026-10-18 06:29:19 current | 85 | critical | 90% | shop-v2-d92668ce |
Evidence · chain of custody ? ⚙ immutable · DB-enforced
Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.
| Observed (UTC) | Type | Role | Source | SHA-256 | Details | |
|---|---|---|---|---|---|---|
| 2026-10-18 06:29:19 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-18 06:29:19 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-18 06:29:19 | reputation | context | mock:virustotal | — | status: unknown | |
| 2026-10-18 06:29:19 | whois | primary | mock:rdap | — | status: positive | |
| 2026-10-18 06:29:19 | favicon | context | mock:playwright | 10d2abb19166a6e2 | mmh3: 1931410676 phash: 968e61399636d9cc | artifact |
| 2026-10-18 06:29:19 | screenshot · datacenter view | context | mock:playwright | 1ea9dbb9f43df1e6 | phash: 9b4ac4959fc4925b dhash: e811193b5b1d8201 palette: ['#fbf7f2', '#f3eee9', '#fe… | artifact |
| 2026-10-18 06:29:19 | html · datacenter view | primary | mock:playwright | eaf15e9cd752eca1 | title: ONE STYLE | ShopNova Runner… forms: 0 parked: False | artifact |
| 2026-10-18 06:29:19 | http | supporting | mock:playwright | eaf15e9cd752eca1 | status: 200 final_url: https://onestyle-shopping.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-18 06:29:19 | dns | supporting | mock:local_dns | — | status: positive | |
| 2026-10-12 06:46:00 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:46:00 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:46:00 | reputation | context | mock:virustotal | — | status: unknown |
show all 27 evidence rows from 3 scan(s)
| 2026-10-12 06:46:00 | whois | primary | mock:rdap | — | status: positive | |
| 2026-10-12 06:46:00 | favicon | context | mock:playwright | 10d2abb19166a6e2 | mmh3: 1931410676 phash: 968e61399636d9cc | artifact |
| 2026-10-12 06:46:00 | screenshot · datacenter view | context | mock:playwright | 1ea9dbb9f43df1e6 | phash: 9b4ac4959fc4925b dhash: e811193b5b1d8201 palette: ['#fbf7f2', '#f3eee9', '#fe… | artifact |
| 2026-10-12 06:46:00 | html · datacenter view | primary | mock:playwright | eaf15e9cd752eca1 | title: ONE STYLE | ShopNova Runner… forms: 0 parked: False | artifact |
| 2026-10-12 06:46:00 | http | supporting | mock:playwright | eaf15e9cd752eca1 | status: 200 final_url: https://onestyle-shopping.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-12 06:46:00 | dns | supporting | mock:local_dns | — | status: positive | |
| 2026-10-12 06:41:46 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:41:46 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:41:46 | reputation | context | mock:virustotal | — | status: unknown | |
| 2026-10-12 06:41:46 | whois | primary | mock:rdap | — | status: positive | |
| 2026-10-12 06:41:46 | favicon | context | mock:playwright | 10d2abb19166a6e2 | mmh3: 1931410676 phash: 968e61399636d9cc | artifact |
| 2026-10-12 06:41:46 | screenshot · datacenter view | context | mock:playwright | 1ea9dbb9f43df1e6 | phash: 9b4ac4959fc4925b dhash: e811193b5b1d8201 palette: ['#fbf7f2', '#f3eee9', '#fe… | artifact |
| 2026-10-12 06:41:46 | html · datacenter view | primary | mock:playwright | eaf15e9cd752eca1 | title: ONE STYLE | ShopNova Runner… forms: 0 parked: False | artifact |
| 2026-10-12 06:41:46 | http | supporting | mock:playwright | eaf15e9cd752eca1 | status: 200 final_url: https://onestyle-shopping.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-12 06:41:46 | dns | supporting | mock:local_dns | — | status: positive |