100
risk ?
shopnova-login.com
Gemini sends users who ask about ShopNova to shopnova-login.com, which is not one of ShopNova's sites.
found by AI answer (ChatGPT / Gemini / Google AI Mode)
confidence ?70%
web address · given by 1 assistant
hosted 
203.0.113.66
registrar Mock Registrar LLC
203.0.113.66
registrar Mock Registrar LLC
A web address an AI assistant gives for ShopNova, not a website: what the assistants said and what the pages say are in the AI answer tab.
What do I do · review the evidence below, then give a verdict
The answer sends users to a site that is not ShopNova’s → confirm; that site is checked as a suspect of its own.
Notes · for you and the next analyst — kept with the finding, never edited, also in Activity
No notes yet.
WEB ADDRESS GIVEN BY
Geminishopnova-login.com
sends users to a site that is not the brand's
- Gemini sent users to shopnova-login.com, which is not a site of ShopNova
- shopnova-login.com is a phishing site BrandWatch confirmed
- shopnova-login.com carries the brand's name but is not one of its domains
The contacts ShopNova publishes on its own site: 03-6000000 · *6700 · *6711 · support@shopnova.com · +972506000000 — all of them, with their pages
What the assistants said
Gemini asked “Where do I log in to my ShopNova account? What is the address?” en
You can log in to ShopNova at https://shopnova-login.com/ with your e-mail and password, or through the ShopNova app.
- source: ShopNova — Sign in — https://shopnova-login.com/
What the pages really say · BrandWatch opened every page the assistants cited — their word is never taken
| Page | The brand's? | Carries shopnova-login.com? | |
|---|---|---|---|
| https://shopnova-login.com/ | no | — | carries the brand's namea phishing site BrandWatch confirmed |
What to do
- Take the page that publishes it down: it was sent to the website checks of this scan — see its own finding in Findings.
- Report the answer to the assistant: in Gemini, ask the same question and use the answer's thumbs-down / report button with the text below. Nothing is sent from BrandWatch.
- Make the real contacts easy for assistants to read: one contact page, the numbers as text (not only in images), and schema.org ContactPoint markup on it.
Explain Finding — why it was flagged · every signal, its points and the evidence behind it
| Signal | Group | Points | Evidence |
|---|---|---|---|
| a known phishing site ai_known_suspect | Reputation | +40 | shopnova-login.com is a phishing site BrandWatch confirmed |
| sends users elsewhere ai_url_not_official | Identity | +40 | Gemini sent users to shopnova-login.com, which is not a site of ShopNova |
| published by a look-alike ai_offsite_lookalike | Infrastructure | +30 | shopnova-login.com carries the brand's name but is not one of its domains |
How the score adds up
⚙ deterministic · versioned Raw 100 of 100 → normalised to 100 / 100.
Thresholds: Medium 25 · High 50 · Critical 75 · scoring aianswer-v1-e26ad54f
open the arithmetic ↗ — this site's section of the scan trace
Group caps ? · stop correlated evidence from double counting
Identity
40 / 100
Reputation
40 / 100
Infrastructure
30 / 100
Confidence ? · 70%
| Breadth (3 independent groups) | +65 |
| Hard confirmers | +0 |
| Evidence completeness | +5 |
| Provider agreement | +0 |
| Unavailable evidence | 0 |
| Single weak signal | 0 |
Suspect vs. official
shopnova-login.com
No screenshot captured (unavailable — not "clean").
the real ShopNova ?
0
VirusTotal · security vendors
0 of 90 engines flag this domain
malicious 0 · suspicious 0 · community reputation 0
Server reputation · AbuseIPDB
25 or more = several defenders reported abuse from this server.
Categories
uncategorized Mock Category Service
JARM
3c26a40d85a2f3dc024ae9233efaa58f748f853c96856ed65c0b5de20054bd
Engines flagged first
| Engine | Category | Result | Method |
|---|---|---|---|
| BitDefender | harmless | clean | blacklist |
| CRDF | harmless | clean | blacklist |
| ESET | harmless | clean | blacklist |
| Fortinet | harmless | clean | blacklist |
| Google Safebrowsing | harmless | clean | blacklist |
| Kaspersky | harmless | clean | blacklist |
| Netcraft | harmless | clean | blacklist |
| OpenPhish | harmless | clean | blacklist |
| Phishtank | harmless | clean | blacklist |
| Quttera | harmless | clean | blacklist |
| Sophos | harmless | clean | blacklist |
| Webroot | harmless | clean | blacklist |
Look it up elsewhere
Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.
Registration data (RDAP)
- Name
- shopnova-login.com
- registration
- 2026-10-04
- Status
- —
- DNSSEC
- —
Registrar & abuse contact
- Registrar
- Mock Registrar LLC
- Abuse email
- —
- registrant email
- kitops@proton.example
Nameservers
—Current WHOIS record (VirusTotal)
Domain Name: SHOPNOVA-LOGIN.COM
Registrar: Mock Registrar LLC
Registrar Abuse Contact Email: abuse@mock-registrar.example
Creation Date: 2026-10-04T00:00:00Z
Name Server: NS1.MOCK-DNS.EXAMPLE
Registrant Country: US
WHOIS history · every WHOIS snapshot WhoisXML has recorded for shopnova-login.com
Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.
First registered
2026-10-04
Mock Registrar LLC
Snapshots
1
2026-10-05 → 2026-10-05
Owners seen
1 visible
0 owner change(s)
Registrars
1
0 transfer(s) · Mock Registrar LLC
Owner details now
Visible
published in WHOIS
Same owner e-mail on other domains in this workspace
kitops@proton.example → secure-shopnova.com shopn0va.com shopnova.co
Found in other domains' WHOIS history and in the WHOIS evidence of your scans — no extra API call. One operator, several kits.
TIMELINE
- 2026-10-04Registered by kitops@proton.examplevia Mock Registrar LLC · first WHOIS snapshot 2026-10-05
SNAPSHOTS · CHANGED FIELDS MARKED
| Seen | Registrar | Registrant | Created · expires |
|---|---|---|---|
| 2026-10-05 | Mock Registrar LLC | kitops@proton.example | 2026-10-04 · 2027-10-04 |
raw WHOIS · 2026-10-05Domain Name: SHOPNOVA-LOGIN.COM
Registrar: Mock Registrar LLC
Creation Date: 2026-10-04T00:00:00Z
Updated Date: 2026-10-05T00:00:00Z
Registry Expiry Date: 2027-10-04T00:00:00Z
Registrant Organization:
Registrant Name:
Registrant Email: kitops@proton.example
Name Server: NS1.MOCK-DNS.EXAMPLE
Name Server: NS2.MOCK-DNS.EXAMPLE | |||
Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .
DNS records source: VirusTotal
A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).
| Type | TTL | Value |
|---|---|---|
| A | 300 | 203.0.113.66 |
| AAAA | 300 | 2001:db8::7696 |
| NS | 21600 | ns1.mock-dns.example |
| NS | 21600 | ns2.mock-dns.example |
| MX | 3600 | mail.shopnova-login.com prio 10 |
| SOA | 1800 | ns1.mock-dns.example rname hostmaster.shopnova-login.com · serial 2026100801 |
HTTPS certificate from VirusTotal
- Common name
- shopnova-login.com
- Issuer
- C=US O=Mock Trust Services CN=MT1
- Valid
- 2026-09-20 00:00:00 → 2026-12-19 00:00:0032% of the validity period elapsed
- Alt names (2)
- shopnova-login.com www.shopnova-login.com
- SHA-256
- 74be7b3bc11f151a0b1978f70ab475b4ca14ecd749d7424298545cf619cf1f3f · crt.sh ↗
serial, signature, key, TLS and the full certificate
- Subject
- CN=shopnova-login.com
- Serial
- c660b035
- Signature
- sha256ECDSA
- Public key
- EC secp256r1
- SHA-1
- 8482d29c938af20bd147637ca22f9ace6b9869cb
{
"cert_signature": {
"signature_algorithm": "sha256ECDSA"
},
"extensions": {
"subject_alternative_name": [
"shopnova-login.com",
"www.shopnova-login.com"
]
},
"issuer": {
"C": "US",
"CN": "MT1",
"O": "Mock Trust Services"
},
"public_key": {
"algorithm": "EC",
"ec": {
"oid": "secp256r1"
}
},
"serial_number": "c660b035",
"subject": {
"CN": "shopnova-login.com"
},
"thumbprint": "8482d29c938af20bd147637ca22f9ace6b9869cb",
"thumbprint_sha256": "74be7b3bc11f151a0b1978f70ab475b4ca14ecd749d7424298545cf619cf1f3f",
"validity": {
"not_after": "2026-12-19 00:00:00",
"not_before": "2026-09-20 00:00:00"
},
"version": "V3"
}
3
203.0.113.66
Netherlands · Amsterdam · AS64531 · BulletproofHost BV · 203.0.113.0/24 · RIPE NCC
3 of 94 engines flag this IP
· 8 sites hosted, 3 flagged · 4 communicating files
Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days
87/ 100
143 report(s) from 38 reporter(s) · last 2026-10-14 01:49
Data Center/Web Hosting/Transit · BulletproofHost BV
A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.
SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)
| Last resolved | Detections | Domain | |
|---|---|---|---|
| 2026-10-13 | 5/ 95 | shopn0va.com | VT ↗ · urlscan ↗ |
| 2026-10-07 | 5/ 95 | shopnova.co | VT ↗ · urlscan ↗ |
| 2026-10-01 | 5/ 95 | wallet-sync-1366.online | VT ↗ · urlscan ↗ |
| 2026-10-05 | 0/ 90 | secure-login-1366.top | VT ↗ · urlscan ↗ |
| 2026-10-09 | 0/ 90 | secure-shopnova.com | VT ↗ · urlscan ↗ |
| 2026-10-11 | 0/ 90 | shopnova-login.com | VT ↗ · urlscan ↗ |
| 2026-09-29 | 0/ 90 | support-desk-1366.site | VT ↗ · urlscan ↗ |
| 2026-10-03 | 0/ 90 | verify-account-1366.xyz | VT ↗ · urlscan ↗ |
COMMUNICATING FILES
| Scanned | Detections | Type | Name |
|---|---|---|---|
| 2026-10-09 | 6/ 66 | Android | Draky and the Twilight Castle.apk |
| 2026-09-21 | 5/ 66 | Android | Orbit - Igra s gravitaciey.apk |
| 2026-09-12 | 4/ 66 | invoice_4411.pdf | |
| 2026-09-30 | 0/ 66 | REMITTANCE 2-For-Cokecanada.pdf |
HISTORICAL WHOIS (IP block)
2026-09-12 · Mock Registrar LLC
IP WHOIS record
inetnum: 203.0.113.0 - 203.0.113.255
org-name: BulletproofHost BV
abuse-mailbox: abuse@bulletproofhost.example
engine verdicts for this IP (12)
| Engine | Category | Result |
|---|---|---|
| BitDefender | malicious | phishing |
| ESET | malicious | phishing |
| Fortinet | malicious | phishing |
| Google Safebrowsing | malicious | phishing |
| Kaspersky | malicious | phishing |
| OpenPhish | malicious | phishing |
| Phishtank | malicious | phishing |
| Sophos | malicious | phishing |
| CRDF | harmless | clean |
| Netcraft | harmless | clean |
| Quttera | harmless | clean |
| Webroot | harmless | clean |
urlscan.io scan
not flagged by urlscan
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-14 07:49
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-14 07:49
title: shopnova-login.com - Sign in
domains contacted by the page (2)
shopnova-login.com · cdn.mock-static.example
Similar sites 29
Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.
Same page (identical document hash) 3hash:4585c68e5a2989efc1756ed0dce0f65bbb5bbb717c8f83908b3b382c9f450bf6
the same HTML served elsewhere — the same phishing kit
Same server 0page.ip:203.0.113.66
other pages scanned on the same IP
noneSame brand name 26page.domain:*shopnova*
domains containing the brand name
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-10-14 | — | shopnova-partners.com |
urlscan ↗ · VT ↗ | shopnova-partners.com - Sign in |
| 2026-10-13 | — | shopnova-blog.net |
urlscan ↗ · VT ↗ | shopnova-blog.net - Sign in |
| 2026-10-12 | — | shopnovafans.com |
urlscan ↗ · VT ↗ | shopnovafans.com - Sign in |
| 2026-10-11 | — | shopnova-reviews.com |
urlscan ↗ · VT ↗ | shopnova-reviews.com - Sign in |
| 2026-10-10 | — | shopnova-careers.com |
urlscan ↗ · VT ↗ | shopnova-careers.com - Sign in |
| 2026-10-09 | — | shopnova-deals.com |
urlscan ↗ · VT ↗ | shopnova-deals.com - Sign in |
| 2026-10-08 | — | shopnova-status.com |
urlscan ↗ · VT ↗ | shopnova-status.com - Sign in |
| 2026-10-07 | — | shopnova-community.org |
urlscan ↗ · VT ↗ | shopnova-community.org - Sign in |
| 2026-10-06 | — | shopnova-press.com |
urlscan ↗ · VT ↗ | shopnova-press.com - Sign in |
| 2026-10-05 | — | shopnova-events.com |
urlscan ↗ · VT ↗ | shopnova-events.com - Sign in |
| 2026-09-24 | — | shopnova.com |
urlscan ↗ · VT ↗ | shopnova.com - Sign in |
| 2026-09-23 | — | www.shopnova.com |
urlscan ↗ · VT ↗ | www.shopnova.com - Sign in |
| 2026-09-22 | — | shopnova.co.il |
urlscan ↗ · VT ↗ | shopnova.co.il - Sign in |
| 2026-09-13 | — | shopnova-verify.com |
urlscan ↗ · VT ↗ | shopnova-verify.com - Sign in |
| 2026-09-10 | — | shopnova-account.net |
urlscan ↗ · VT ↗ | shopnova-account.net - Sign in |
| 2026-09-09 | — | shopnova-support-center.com |
urlscan ↗ · VT ↗ | shopnova-support-center.com - Sign in |
| 2026-09-06 | — | shopnova-giftcard.com |
urlscan ↗ · VT ↗ | shopnova-giftcard.com - Sign in |
| 2026-09-05 | — | shopnova-refund.net |
urlscan ↗ · VT ↗ | shopnova-refund.net - Sign in |
| 2026-09-04 | — | shopnova-verification.com |
urlscan ↗ · VT ↗ | shopnova-verification.com - Sign in |
| 2026-09-03 | — | shopnova--sneakers.com |
urlscan ↗ · VT ↗ | shopnova--sneakers.com - Sign in |
| 2026-09-02 | — | shopnova-eu.com |
urlscan ↗ · VT ↗ | shopnova-eu.com - Sign in |
| 2026-09-01 | — | shopnova-id-check.com |
urlscan ↗ · VT ↗ | shopnova-id-check.com - Sign in |
| 2026-08-20 | — | shopnova-support.com |
urlscan ↗ · VT ↗ | shopnova-support.com - Sign in |
| 2026-08-19 | — | shopnova-review.com |
urlscan ↗ · VT ↗ | shopnova-review.com - Sign in |
| 2026-08-18 | — | shopnova-coupons.com |
urlscan ↗ · VT ↗ | shopnova-coupons.com - Sign in |
Passive DNS replication 1
Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.
| Date resolved | Detections (IP) | IP |
|---|---|---|
| 2026-09-27 | 3/ 92 | 203.0.113.66 |
Subdomains 3
| Host | Detections |
|---|---|
| login.shopnova-login.com | 2/ 92 |
| mail.shopnova-login.com | 0/ 90 |
| www.shopnova-login.com | 0/ 90 |
Communicating files 0 not fetched yet
Malware samples that contacted this domain while being analysed.
Historical WHOIS · VirusTotal 1
2026-09-14 · Mock Registrar LLC
- Registrant Organization
- REDACTED FOR PRIVACY
- Registrant Country
- US
- Name Server
- NS1.MOCK-DNS.EXAMPLE
Historical certificates 0 VT · 2 CT not fetched yet
CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains
| Not before | Names | Issuer |
|---|---|---|
| 2026-09-30 | shopnova-login.com, www.shopnova-login.com | C=US, O=Let's Encrypt, CN=R3 |
| 2026-09-01 | mail0.shopnova-login.com-cdn.net | Mock CA |
Observation timeline
- 2026-10-18 07:29:25 · HTTP — · state new · datacenter · efe86f7113b3
- 2026-10-18 07:32:12 · HTTP — · state flagged · datacenter · efe86f7113b3
first seen 2026-10-18 07:29 · scans 2 · next — · candidate state flagged · WHOIS history →
Score history
| When | Score | Severity | Confidence | Version |
|---|---|---|---|---|
| 2026-10-18 07:29:25 | 100 | critical | 70% | aianswer-v1-e26ad54f |
| 2026-10-18 07:32:12 current | 100 | critical | 70% | aianswer-v1-e26ad54f |
Evidence · chain of custody ? ⚙ immutable · DB-enforced
Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.
| Observed (UTC) | Type | Role | Source | SHA-256 | Details | |
|---|---|---|---|---|---|---|
| 2026-10-18 07:32:12 | http | supporting | searchapi:ai_answers | efe86f7113b380e0 | status: positive kind: url value: shopnova-login.com +1 | artifact |
| 2026-10-18 07:29:25 | http | supporting | searchapi:ai_answers | efe86f7113b380e0 | status: positive kind: url value: shopnova-login.com +1 | artifact |