9 open38 to send
85
risk ?
critical likely counterfeit seller confirmed · likely fake brand ShopNova

onestyle-shopping.com

Registered 21 days ago. A .com shop in Hebrew selling ShopNova products at 350 ILS per item — 44% of the official 799 ILS. Its only e-mail is Gmail (onestyle.store@gmail.com), it has no privacy policy, terms or returns page and company number 516728391 does not exist in the Israeli Registrar of Companies (recorded). Search results about it mention scams or replica products.

found by Facebook / Instagram ads, Facebook pages / Instagram profiles confidence ?90% domain name · https://onestyle-shopping.com/ hosted DE198.51.100.40 registrar Mock Registrar LLC
THREAT INTEL · what public blocklists say about this site — each card opens the lookup
Not on public blocklists yet — they lag by hours or days. BrandWatch found it first; unknown is never treated as safe.

What do I do · get it taken down

✓ Confirmed · Likely counterfeit seller ·
by admin
change the conclusion
— the takedown subject follows; a drafted letter can be rewritten on the takedown page
Attack infrastructure: mapped → open the map
domain timeline evidence packages:json · html ·

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

No notes yet.

Conclusion · how sure are we that it sells fakes? — every letter and report claims only this

1 · Suspicious shopsigns that justify a closer look — not proof that the goods are fake
2 · Likely counterfeit sellerindependent evidence about the goods and about the seller point to counterfeits the analyst’s conclusion
3 · Confirmed counterfeitdirect proof: a test purchase, the brand's inspection of the product, or a platform's confirmation

BrandWatch reads “Likely counterfeit seller” because: the price is half the official price or less · reviews say the goods are fake · reviews report a scam or orders that never arrived · the company is not in the registry, is dissolved, or is another business · the seller is anonymous — no company details, or nothing about it on Google.

What would move it up:

  • for “Confirmed counterfeit”: a test purchase, the brand's inspection of the product, or a platform's confirmation

Concluded by admin · 2026-10-14 09:50

Shop checks · is this a real seller of ShopNova products? · separate from the phishing score (shop-v2-d92668ce)

✓
About ShopNova
the page names “shopnova”
✕
Company number not in the registry
516728391 (ח.פ.) does not exist in the Israeli Registrar of Companies (recorded)
✕
No privacy, terms or returns page
a real shop links them from every page
✕
Free-mail contact only
onestyle.store@gmail.com
✕
WhatsApp / phone only
no e-mail on the shop’s own domain
✓
Company details on the page
516728391
✕
Half the official price or less
350 ILS per item (⁨אול עליו שוב ושוב 👀 2 זוגות ShopNova Runner ב-699 ⁩) — 44% of the official 799 ILS (ShopNova Runner)
✕
Multi-buy offer
multi-buy offer: “⁨אול עליו שוב ושוב 👀 2 זוגות ShopNova Runner ב-699 ₪ — בוחרים⁩”
✕
New domain
domain registered 21 day(s) ago
✕
Local language, generic domain
a .com site written in he — a local shop without the country's domain ending
✕
No footprint on Google
Google finds nothing about “516728391” outside the shop itself
✕
Reviews mention scam / replica
a search result about the shop mentions “⁨עוקץ⁩”: ⁨onestyle-shopping.com — קיבלתי רפליקה⁩
search results about the shop (1)

AI: is this shop legitimate? · advisory, never part of the score

LIKELY SCAM
95% · mock:openai · likely sells replicas
  • no privacy policy, terms or returns page linked from the shop's page
  • the only contact e-mail is a free mailbox (onestyle.store@gmail.com)
  • contact is WhatsApp / phone only — no e-mail on the shop's own domain
  • multi-buy offer: “⁨אול עליו שוב ושוב 👀 2 זוגות ShopNova Runner ב-699 ₪ — בוחרים⁩”
  • a .com site written in he — a local shop without the country's domain ending
  • domain registered 21 day(s) ago

reviews mention fake or replica products

Where it was found

Country IL · page language he · built on Shopify

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

SignalGroupPointsEvidence
company number not in the registry
shop_company_not_in_registry
Seller+25company number 516728391 (ח.פ.) does not exist in the Israeli Registrar of Companies (recorded)
half the official price or less
shop_price_far_below_official
Offer+20350 ILS per item (⁨אול עליו שוב ושוב 👀 2 זוגות ShopNova Runner ב-699 ⁩) — 44% of the official 799 ILS (ShopNova Runner)
reviews say scam / replica
shop_reviews_warn
Reputation+15a search result about the shop mentions “⁨עוקץ⁩”: ⁨onestyle-shopping.com — קיבלתי רפליקה⁩
Gmail-type contact only
shop_free_email_only
Contact & policies+12the only contact e-mail is a free mailbox (onestyle.store@gmail.com)
new domain
shop_new_domain
Freshness+12domain registered 21 day(s) ago
no privacy / terms / returns
shop_no_policy_pages
Contact & policies+12no privacy policy, terms or returns page linked from the shop's page
no footprint on Google
shop_no_web_presence
Seller+10Google finds nothing about “516728391” outside the shop itself
WhatsApp / phone only
shop_chat_or_phone_only
Contact & policies+6contact is WhatsApp / phone only — no e-mail on the shop's own domain
show all 10 signals
multi-buy offer
shop_multibuy_bait
Offer+6multi-buy offer: “⁨אול עליו שוב ושוב 👀 2 זוגות ShopNova Runner ב-699 ₪ — בוחרים⁩”
local language, generic domain
shop_tld_language_mismatch
Seller+6a .com site written in he — a local shop without the country's domain ending

How the score adds up

⚙ deterministic · versioned Raw 85 of 100 → normalised to 85 / 100. Thresholds: Medium 25 · High 50 · Critical 75 · scoring shop-v2-d92668ce
open the arithmetic ↗ — this site's section of the scan trace

Group caps ? · stop correlated evidence from double counting

Contact & policies
30 → 15
Offer
26 → 22
Seller
41 → 25
Freshness
12 → 8
Reputation
15 / 15

Confidence ? · 90%

Breadth (5 independent groups)+70
Hard confirmers +0
Evidence completeness+20
Provider agreement+0
Unavailable evidence 0
Single weak signal0

Suspect vs. official similarity 53%

onestyle-shopping.com
suspect
the real ShopNova ?
official
0

VirusTotal · security vendors

0 of 90 engines flag this domain
malicious 0 · suspicious 0 · community reputation 0

Server reputation · AbuseIPDB

DE198.51.100.40 0/ 1000 report(s)
25 or more = several defenders reported abuse from this server.

Categories

uncategorized Mock Category Service

JARM

0e2398d18ea7429f37f08caf265dbe26067728d34828714f98bbb3aae96395

Engines flagged first

EngineCategoryResultMethod
BitDefenderharmlesscleanblacklist
CRDFharmlesscleanblacklist
ESETharmlesscleanblacklist
Fortinetharmlesscleanblacklist
Google Safebrowsingharmlesscleanblacklist
Kasperskyharmlesscleanblacklist
Netcraftharmlesscleanblacklist
OpenPhishharmlesscleanblacklist
Phishtankharmlesscleanblacklist
Qutteraharmlesscleanblacklist
Sophosharmlesscleanblacklist
Webrootharmlesscleanblacklist

Look it up elsewhere

Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.

Registration data (RDAP)

Name
onestyle-shopping.com
registration
2026-09-23
Status
—
DNSSEC
—

Registrar & abuse contact

Registrar
Mock Registrar LLC
Abuse email
—
registrant org
REDACTED FOR PRIVACY

Nameservers

—
Current WHOIS record (VirusTotal)
Domain Name: ONESTYLE-SHOPPING.COM Registrar: Mock Registrar LLC Registrar Abuse Contact Email: abuse@mock-registrar.example Creation Date: 2026-09-23T00:00:00Z Name Server: NS1.MOCK-DNS.EXAMPLE Registrant Country: US

WHOIS history · every WHOIS snapshot WhoisXML has recorded for onestyle-shopping.com

Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.

First registered

2026-09-23
Mock Registrar LLC

Snapshots

1
2026-09-24 → 2026-09-24

Owners seen

0 visible
0 owner change(s)

Registrars

1
0 transfer(s) · Mock Registrar LLC

Owner details now

Hidden
privacy since registration

TIMELINE

  • 2026-09-23
    Registered with privacy on
    registrant shown as 'REDACTED FOR PRIVACY' · via Mock Registrar LLC · first WHOIS snapshot 2026-09-24

SNAPSHOTS · CHANGED FIELDS MARKED

SeenRegistrarRegistrantCreated · expires
2026-09-24 Mock Registrar LLC hidden · REDACTED FOR PRIVACY 2026-09-23 · 2027-09-23
raw WHOIS · 2026-09-24
Domain Name: ONESTYLE-SHOPPING.COM Registrar: Mock Registrar LLC Creation Date: 2026-09-23T00:00:00Z Updated Date: 2026-09-24T00:00:00Z Registry Expiry Date: 2027-09-23T00:00:00Z Registrant Organization: REDACTED FOR PRIVACY Registrant Name: Registrant Email: Name Server: NS1.MOCK-DNS.EXAMPLE Name Server: NS2.MOCK-DNS.EXAMPLE

Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .

DNS records source: VirusTotal

A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).

TypeTTLValue
A300 198.51.100.40
AAAA300 2001:db8::e23c
NS21600 ns1.mock-dns.example
NS21600 ns2.mock-dns.example
MX3600 mail.onestyle-shopping.com prio 10
SOA1800 ns1.mock-dns.example rname hostmaster.onestyle-shopping.com · serial 2026100801

HTTPS certificate from VirusTotal

Common name
onestyle-shopping.com
Issuer
C=US O=Mock Trust Services CN=MT1
Valid
2026-09-20 00:00:00 → 2026-12-19 00:00:00
32% of the validity period elapsed
Alt names (2)
onestyle-shopping.com www.onestyle-shopping.com
SHA-256
8f048ae75cd2f160d70cf6f170ab47c67da7ae2cb2cb8c35e72bda8f71719b9b · crt.sh ↗
serial, signature, key, TLS and the full certificate
Subject
CN=onestyle-shopping.com
Serial
1061d1db
Signature
sha256ECDSA
Public key
EC secp256r1
SHA-1
1adf10567c16e3af1aebdd194f7bef3c0abc3291
{ "cert_signature": { "signature_algorithm": "sha256ECDSA" }, "extensions": { "subject_alternative_name": [ "onestyle-shopping.com", "www.onestyle-shopping.com" ] }, "issuer": { "C": "US", "CN": "MT1", "O": "Mock Trust Services" }, "public_key": { "algorithm": "EC", "ec": { "oid": "secp256r1" } }, "serial_number": "1061d1db", "subject": { "CN": "onestyle-shopping.com" }, "thumbprint": "1adf10567c16e3af1aebdd194f7bef3c0abc3291", "thumbprint_sha256": "8f048ae75cd2f160d70cf6f170ab47c67da7ae2cb2cb8c35e72bda8f71719b9b", "validity": { "not_after": "2026-12-19 00:00:00", "not_before": "2026-09-20 00:00:00" }, "version": "V3" }
0

DE198.51.100.40

Germany · Frankfurt · AS64578 · Mock Hosting LLC · 198.51.100.0/24 · RIPE NCC
0 of 94 engines flag this IP · 5 sites hosted, 2 flagged · 0 communicating files

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

0/ 100
No reports in the last 90 days
Data Center/Web Hosting/Transit · Mock Hosting LLC
A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

Last resolvedDetectionsDomain
2026-10-135/ 95onestyle-shopping.com VT ↗ · urlscan ↗
2026-10-075/ 95wallet-sync-0040.online VT ↗ · urlscan ↗
2026-10-110/ 90secure-login-0040.top VT ↗ · urlscan ↗
2026-10-050/ 90support-desk-0040.site VT ↗ · urlscan ↗
2026-10-090/ 90verify-account-0040.xyz VT ↗ · urlscan ↗

COMMUNICATING FILES not fetched yet

IP WHOIS record
inetnum: 198.51.100.0 - 198.51.100.255 org-name: Mock Hosting LLC abuse-mailbox: abuse@mock.example
engine verdicts for this IP (12)
EngineCategoryResult
BitDefenderharmlessclean
CRDFharmlessclean
ESETharmlessclean
Fortinetharmlessclean
Google Safebrowsingharmlessclean
Kasperskyharmlessclean
Netcraftharmlessclean
OpenPhishharmlessclean
Phishtankharmlessclean
Qutteraharmlessclean
Sophosharmlessclean
Webrootharmlessclean

urlscan.io scan

not flagged by urlscan NLNetherlands 203.0.113.66AS64512 BulletproofHost BV server nginx 23 requests · 2 domains · 1 IPs · 1 countries scanned 2026-10-14 09:50
title: onestyle-shopping.com - Sign in
urlscan screenshot
domains contacted by the page (2)
onestyle-shopping.com · cdn.mock-static.example

Similar sites 30

Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.

Same page (identical document hash) 4hash:fa10cb06cd1e8e2275ea93e0f0be5c99d299fd1ccd315b0dc845c9ff7e561d24

the same HTML served elsewhere — the same phishing kit

SeenVerdictDomainTitle
2026-09-16— NLshopn0va.com urlscan ↗ · VT ↗ shopn0va.com - Sign in
2026-09-15— NLshopnova-login.com urlscan ↗ · VT ↗ shopnova-login.com - Sign in
2026-09-14— NLsecure-shopnova.com urlscan ↗ · VT ↗ secure-shopnova.com - Sign in
2026-09-08— NLshopnova.co urlscan ↗ · VT ↗ shopnova.co - Sign in

Same server 0page.ip:203.0.113.66

other pages scanned on the same IP

none

Same brand name 26page.domain:*shopnova*

domains containing the brand name

SeenVerdictDomainTitle
2026-10-14— NLshopnova-partners.com urlscan ↗ · VT ↗ shopnova-partners.com - Sign in
2026-10-13— NLshopnova-blog.net urlscan ↗ · VT ↗ shopnova-blog.net - Sign in
2026-10-12— NLshopnovafans.com urlscan ↗ · VT ↗ shopnovafans.com - Sign in
2026-10-11— NLshopnova-reviews.com urlscan ↗ · VT ↗ shopnova-reviews.com - Sign in
2026-10-10— NLshopnova-careers.com urlscan ↗ · VT ↗ shopnova-careers.com - Sign in
2026-10-09— NLshopnova-deals.com urlscan ↗ · VT ↗ shopnova-deals.com - Sign in
2026-10-08— NLshopnova-status.com urlscan ↗ · VT ↗ shopnova-status.com - Sign in
2026-10-07— NLshopnova-community.org urlscan ↗ · VT ↗ shopnova-community.org - Sign in
2026-10-06— NLshopnova-press.com urlscan ↗ · VT ↗ shopnova-press.com - Sign in
2026-10-05— NLshopnova-events.com urlscan ↗ · VT ↗ shopnova-events.com - Sign in
2026-09-24— NLshopnova.com urlscan ↗ · VT ↗ shopnova.com - Sign in
2026-09-23— NLwww.shopnova.com urlscan ↗ · VT ↗ www.shopnova.com - Sign in
2026-09-22— NLshopnova.co.il urlscan ↗ · VT ↗ shopnova.co.il - Sign in
2026-09-13— NLshopnova-verify.com urlscan ↗ · VT ↗ shopnova-verify.com - Sign in
2026-09-10— NLshopnova-account.net urlscan ↗ · VT ↗ shopnova-account.net - Sign in
2026-09-09— NLshopnova-support-center.com urlscan ↗ · VT ↗ shopnova-support-center.com - Sign in
2026-09-06— NLshopnova-giftcard.com urlscan ↗ · VT ↗ shopnova-giftcard.com - Sign in
2026-09-05— NLshopnova-refund.net urlscan ↗ · VT ↗ shopnova-refund.net - Sign in
2026-09-04— NLshopnova-verification.com urlscan ↗ · VT ↗ shopnova-verification.com - Sign in
2026-09-03— NLshopnova--sneakers.com urlscan ↗ · VT ↗ shopnova--sneakers.com - Sign in
2026-09-02— NLshopnova-eu.com urlscan ↗ · VT ↗ shopnova-eu.com - Sign in
2026-09-01— NLshopnova-id-check.com urlscan ↗ · VT ↗ shopnova-id-check.com - Sign in
2026-08-20— NLshopnova-support.com urlscan ↗ · VT ↗ shopnova-support.com - Sign in
2026-08-19— NLshopnova-review.com urlscan ↗ · VT ↗ shopnova-review.com - Sign in
2026-08-18— NLshopnova-coupons.com urlscan ↗ · VT ↗ shopnova-coupons.com - Sign in

Passive DNS replication 1

Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.

Date resolvedDetections (IP)IP
2026-09-273/ 92198.51.100.40

Subdomains 3

HostDetections
login.onestyle-shopping.com2/ 92
mail.onestyle-shopping.com0/ 90
www.onestyle-shopping.com0/ 90

Communicating files 0 not fetched yet

Malware samples that contacted this domain while being analysed.

Historical WHOIS · VirusTotal 1

2026-09-14 · Mock Registrar LLC
Registrant Organization
REDACTED FOR PRIVACY
Registrant Country
US
Name Server
NS1.MOCK-DNS.EXAMPLE

Historical certificates 0 VT · 2 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Not beforeNamesIssuer
2026-09-30onestyle-shopping.com, www.onestyle-shopping.comC=US, O=Let's Encrypt, CN=R3
2026-09-01mail0.onestyle-shopping.com-cdn.netMock CA

Observation timeline

  • 2026-10-12 06:41:46 · HTTP 200 · state new · datacenter · content changed · eaf15e9cd752 · screenshot
  • 2026-10-12 06:46:00 · HTTP 200 · state flagged · datacenter · eaf15e9cd752 · screenshot
  • 2026-10-18 06:29:19 · HTTP 200 · state flagged · datacenter · eaf15e9cd752 · screenshot

first seen 2026-10-12 06:41 · scans 3 · next 2026-10-18 12:29 · candidate state flagged · WHOIS history →

Score history

WhenScoreSeverityConfidenceVersion
2026-10-12 06:41:4685critical90%shop-v2-d92668ce
2026-10-12 06:46:0085critical90%shop-v2-d92668ce
2026-10-18 06:29:19 current85critical90%shop-v2-d92668ce

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.

Observed (UTC)TypeRoleSourceSHA-256Details
2026-10-18 06:29:19 reputation contradicting mock:safebrowsing — status: negative
2026-10-18 06:29:19 reputation context mock:urlhaus — status: unknown
2026-10-18 06:29:19 reputation context mock:virustotal — status: unknown
2026-10-18 06:29:19 whois primary mock:rdap — status: positive
2026-10-18 06:29:19 favicon context mock:playwright 10d2abb19166a6e2 mmh3: 1931410676 phash: 968e61399636d9cc artifact
2026-10-18 06:29:19 screenshot · datacenter view context mock:playwright 1ea9dbb9f43df1e6 phash: 9b4ac4959fc4925b dhash: e811193b5b1d8201 palette: ['#fbf7f2', '#f3eee9', '#fe… artifact
2026-10-18 06:29:19 html · datacenter view primary mock:playwright eaf15e9cd752eca1 title: ONE STYLE | ShopNova Runner… forms: 0 parked: False artifact
2026-10-18 06:29:19 http supporting mock:playwright eaf15e9cd752eca1 status: 200 final_url: https://onestyle-shopping.com/ content_type: text/html; charset=utf-8
2026-10-18 06:29:19 dns supporting mock:local_dns — status: positive
2026-10-12 06:46:00 reputation contradicting mock:safebrowsing — status: negative
2026-10-12 06:46:00 reputation context mock:urlhaus — status: unknown
2026-10-12 06:46:00 reputation context mock:virustotal — status: unknown
show all 27 evidence rows from 3 scan(s)
2026-10-12 06:46:00 whois primary mock:rdap — status: positive
2026-10-12 06:46:00 favicon context mock:playwright 10d2abb19166a6e2 mmh3: 1931410676 phash: 968e61399636d9cc artifact
2026-10-12 06:46:00 screenshot · datacenter view context mock:playwright 1ea9dbb9f43df1e6 phash: 9b4ac4959fc4925b dhash: e811193b5b1d8201 palette: ['#fbf7f2', '#f3eee9', '#fe… artifact
2026-10-12 06:46:00 html · datacenter view primary mock:playwright eaf15e9cd752eca1 title: ONE STYLE | ShopNova Runner… forms: 0 parked: False artifact
2026-10-12 06:46:00 http supporting mock:playwright eaf15e9cd752eca1 status: 200 final_url: https://onestyle-shopping.com/ content_type: text/html; charset=utf-8
2026-10-12 06:46:00 dns supporting mock:local_dns — status: positive
2026-10-12 06:41:46 reputation contradicting mock:safebrowsing — status: negative
2026-10-12 06:41:46 reputation context mock:urlhaus — status: unknown
2026-10-12 06:41:46 reputation context mock:virustotal — status: unknown
2026-10-12 06:41:46 whois primary mock:rdap — status: positive
2026-10-12 06:41:46 favicon context mock:playwright 10d2abb19166a6e2 mmh3: 1931410676 phash: 968e61399636d9cc artifact
2026-10-12 06:41:46 screenshot · datacenter view context mock:playwright 1ea9dbb9f43df1e6 phash: 9b4ac4959fc4925b dhash: e811193b5b1d8201 palette: ['#fbf7f2', '#f3eee9', '#fe… artifact
2026-10-12 06:41:46 html · datacenter view primary mock:playwright eaf15e9cd752eca1 title: ONE STYLE | ShopNova Runner… forms: 0 parked: False artifact
2026-10-12 06:41:46 http supporting mock:playwright eaf15e9cd752eca1 status: 200 final_url: https://onestyle-shopping.com/ content_type: text/html; charset=utf-8
2026-10-12 06:41:46 dns supporting mock:local_dns — status: positive