risk ?

critical awaiting verdict CLOAKED KIT brand ShopNova · Israel

shopnova-eu.com

Registered 6 days ago. Puts the ShopNova · Israel name in its address, copies ShopNova · Israel's favicon, homepage and login form and asks for a password.

registered 6 days ago found by Certificate logs confidence ?92% domain name · https://shopnova-eu.com/ hosted

203.0.113.171 registrar Mock Registrar LLC

Hides from scanners: the real page was revealed by BrandWatch's probes — see Looks like ShopNova · Israel.

THREAT INTEL · what public blocklists say about this site — each card opens the lookup

VirusTotal↗

not flagged

Google Safe Browsing↗

not on Google's list yet — browsers do not warn

Not on public blocklists yet — they lag by hours or days, and this domain is 6 days old. BrandWatch found it first; unknown is never treated as safe.

What do I do · review the evidence below, then give a verdict

High risk and complete evidence → confirm, then draft the takedown.

domain timeline

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

No notes yet.

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

Signal	Group	Points	Evidence
identical favicon favicon_exact	Visual	+22	favicon mmh3 -2029202433 equals the brand's favicon hash
looks like the real site screenshot_similarity_ge_90	Visual	+18	homepage screenshot is 100% similar to the brand's (pHash)
asks for a password credential_form	Behaviour	+14	page contains a password field
brand name in the domain brand_exact_in_domain	Identity	+12	brand 'shopnova' appears inside the domain label 'shopnova-eu'
cloned login form login_dom_similarity	Visual	+12	login form markup is 100% identical to the brand's
registered < 7 days ago age_lt_7d	Freshness	+10	domain registered 6 day(s) ago
page title claims the brand title_claims_brand	Behaviour	+10	the page calls itself the brand: <title>ShopNova — Sign in</title>
blocks bots bot_blocking	Evasion	+8	the site refuses automated visitors: HTTP 403 (Akamai)

show all 14 signals, bonuses

brand + extra word combosquat	Identity	+8	'shopnova-eu' combines the brand with extra words
looks 85%+ like the real site looks_like_brand_ge_85	Visual	+8	the page looks 100% like shopnova's real site: above 85% the risk is very high
registered < 30 days ago age_lt_30d	Freshness	+6	domain registered 6 days ago
brand words in the text brand_keywords_in_content	Behaviour	+6	brand terms in content: shopnova
urgent lure wording lure_language	Behaviour	+6	lure phrases: verify your account; unusual activity; your account will be
same colours palette_match	Visual	+5	100% of the page's dominant colours match the brand's
combination bonus	cluster	+15	favicon_exact + credential_form + brand_exact_in_domain

How the score adds up

⚙ deterministic · versioned Raw 113 of 150 → normalised to 75 / 100 · severity raised to critical by the rule “pixel-perfect clone with a login form (favicon + screenshot + password form)”. Thresholds: Medium 25 · High 50 · Critical 75 · scoring v2-c213b21d+c7
Other rules that fired: a days-old look-alike asking for a password (≥ high); titled as the brand and asking for a password (≥ high); looks like brand verdict (≥ critical)
open the arithmetic ↗ — this site's section of the scan trace

Group caps ? · stop correlated evidence from double counting

Identity

20 / 20

Visual

65 → 30

Behaviour

36 → 30

Infrastructure

0 / 20

Reputation

0 / 15

Freshness

16 → 10

Evasion

8 / 25

Confidence ? · 92%

Breadth (5 independent groups)	+70
Hard confirmers favicon_exact	+15
Evidence completeness	+15
Provider agreement	+0
Unavailable evidence live_page	-8
Single weak signal	0

Suspect vs. official similarity 100%

This picture is a urlscan.io snapshot, not what BrandWatch saw. The live site refuses automated visitors (HTTP 403, Akamai), so its screenshot and page come from a public scan of 2026-10-11 — open it on urlscan.io ↗. It may be older than the site's current look.

Who was refused: BrandWatch's browser visit (datacenter profile, from a data-centre IP) with the User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36. A person's browser also sends sec-ch-ua, sec-fetch-site, sec-fetch-mode, sec-fetch-dest; this visit did not.

every header it sent

user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

accept-language: en-US

accept-encoding: gzip, deflate, br

upgrade-insecure-requests: 1

shopnova-eu.com

the real ShopNova · Israel ?

Cloaking multi-probe ? ⚙ Tier 3/4 multi-probe

Probe	Profile	Login form	Diverged
bot	bot	no	same
param	datacenter	no	same
referer	referer	no	same
residential	residential	no	same

Fetched several ways — a crawler user-agent, a victim-style link (?email=), a Google referer, a phone (when chosen in Settings → Proxy) and a real home or phone-network IP (Tier 4). Residential (Tier 4): used. Residential IPs are used to look, never to interact.

VirusTotal · security vendors

0 of 90 engines flag this domain

malicious 0 · suspicious 0 · community reputation 0

Server reputation · AbuseIPDB

203.0.113.171 71/ 10049 report(s)

25 or more = several defenders reported abuse from this server.

JARM

4c56a92ea26f89232dc4f5ef8f1157bb49c1d32d761bb172457e229626b8a4

Engines flagged first

Engine	Category	Result	Method
BitDefender	harmless	clean	blacklist
CRDF	harmless	clean	blacklist
ESET	harmless	clean	blacklist
Fortinet	harmless	clean	blacklist
Google Safebrowsing	harmless	clean	blacklist
Kaspersky	harmless	clean	blacklist
Netcraft	harmless	clean	blacklist
OpenPhish	harmless	clean	blacklist
Phishtank	harmless	clean	blacklist
Quttera	harmless	clean	blacklist
Sophos	harmless	clean	blacklist
Webroot	harmless	clean	blacklist

Look it up elsewhere

Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.

VirusTotal domain ↗VirusTotal relations ↗urlscan search ↗URLhaus ↗crt.sh ↗Google Safe Browsing ↗Wayback Machine ↗Censys ↗VirusTotal URL ↗VirusTotal IP ↗Shodan ↗AbuseIPDB ↗Censys host ↗

Jump to Registration WHOIS history DNS records Certificate

Registration data (RDAP)

Name: shopnova-eu.com
registration: 2026-10-12
Status: —
DNSSEC: —

Registrar & abuse contact

Registrar: Mock Registrar LLC
Abuse email: —
registrant org: REDACTED FOR PRIVACY

Nameservers

—

Current WHOIS record (VirusTotal)

Domain Name: SHOPNOVA-EU.COM Registrar: Mock Registrar LLC Registrar Abuse Contact Email: abuse@mock-registrar.example Creation Date: 2026-10-12T00:00:00Z Name Server: NS1.MOCK-DNS.EXAMPLE Registrant Country: US

WHOIS history · every WHOIS snapshot WhoisXML has recorded for shopnova-eu.com

Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.

First registered

2026-10-12

Mock Registrar LLC

Snapshots

2026-10-13 → 2026-10-13

Owners seen

0 visible

0 owner change(s)

Registrars

0 transfer(s) · Mock Registrar LLC

Owner details now

Hidden

privacy since registration

TIMELINE

2026-10-12
Registered with privacy on
registrant shown as 'REDACTED FOR PRIVACY' · via Mock Registrar LLC · first WHOIS snapshot 2026-10-13

SNAPSHOTS · CHANGED FIELDS MARKED

Seen	Registrar	Registrant	Created · expires
2026-10-13	Mock Registrar LLC	hidden · REDACTED FOR PRIVACY	2026-10-12 · 2027-10-12
raw WHOIS · 2026-10-13 Domain Name: SHOPNOVA-EU.COM Registrar: Mock Registrar LLC Creation Date: 2026-10-12T00:00:00Z Updated Date: 2026-10-13T00:00:00Z Registry Expiry Date: 2027-10-12T00:00:00Z Registrant Organization: REDACTED FOR PRIVACY Registrant Name: Registrant Email: Name Server: NS1.MOCK-DNS.EXAMPLE Name Server: NS2.MOCK-DNS.EXAMPLE

Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .

DNS records source: VirusTotal

A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).

Type	TTL	Value
A	300	203.0.113.171
AAAA	300	2001:db8::7c52
NS	21600	ns1.mock-dns.example
NS	21600	ns2.mock-dns.example
MX	3600	mail.shopnova-eu.com prio 10
SOA	1800	ns1.mock-dns.example rname hostmaster.shopnova-eu.com · serial 2026100801

HTTPS certificate from VirusTotal

Common name: shopnova-eu.com
Issuer: C=US O=Mock Trust Services CN=MT1
Valid: 2026-09-20 00:00:00 → 2026-12-19 00:00:00
32% of the validity period elapsed
Alt names (2): shopnova-eu.com www.shopnova-eu.com
SHA-256: 121412530401766d4dc42215ee44743ed090495833f19d4fc4c7c75fa74c8a5d · crt.sh ↗

serial, signature, key, TLS and the full certificate

Subject: CN=shopnova-eu.com
Serial: 1c9c5fb6
Signature: sha256ECDSA
Public key: EC secp256r1
SHA-1: cb1789ed704a6a14b0f08724d7b9a22c498b3a91

{ "cert_signature": { "signature_algorithm": "sha256ECDSA" }, "extensions": { "subject_alternative_name": [ "shopnova-eu.com", "www.shopnova-eu.com" ] }, "issuer": { "C": "US", "CN": "MT1", "O": "Mock Trust Services" }, "public_key": { "algorithm": "EC", "ec": { "oid": "secp256r1" } }, "serial_number": "1c9c5fb6", "subject": { "CN": "shopnova-eu.com" }, "thumbprint": "cb1789ed704a6a14b0f08724d7b9a22c498b3a91", "thumbprint_sha256": "121412530401766d4dc42215ee44743ed090495833f19d4fc4c7c75fa74c8a5d", "validity": { "not_after": "2026-12-19 00:00:00", "not_before": "2026-09-20 00:00:00" }, "version": "V3" }

Jump to Servers urlscan & similar sites Passive DNS & relations

203.0.113.171

Brazil · Sao Paulo · AS64553 · Mock Hosting LLC · 203.0.113.0/24 · RIPE NCC

0 of 94 engines flag this IP · 5 sites hosted, 2 flagged · 0 communicating files

VirusTotal IP ↗Shodan ↗AbuseIPDB ↗Censys host ↗ open server page →

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

71/ 100

49 report(s) from 9 reporter(s) · last 2026-10-18 17:00

Data Center/Web Hosting/Transit · Mock Hosting LLC

A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

Last resolved	Detections	Domain
2026-10-17	5/ 95	shopnova-eu.com	VT ↗ · urlscan ↗
2026-10-11	5/ 95	wallet-sync-3171.online	VT ↗ · urlscan ↗
2026-10-15	0/ 90	secure-login-3171.top	VT ↗ · urlscan ↗
2026-10-09	0/ 90	support-desk-3171.site	VT ↗ · urlscan ↗
2026-10-13	0/ 90	verify-account-3171.xyz	VT ↗ · urlscan ↗

COMMUNICATING FILES not fetched yet

IP WHOIS record

inetnum: 203.0.113.0 - 203.0.113.255 org-name: Mock Hosting LLC abuse-mailbox: abuse@mock.example

engine verdicts for this IP (12)

Engine	Category	Result
BitDefender	harmless	clean
CRDF	harmless	clean
ESET	harmless	clean
Fortinet	harmless	clean
Google Safebrowsing	harmless	clean
Kaspersky	harmless	clean
Netcraft	harmless	clean
OpenPhish	harmless	clean
Phishtank	harmless	clean
Quttera	harmless	clean
Sophos	harmless	clean
Webroot	harmless	clean

urlscan.io scan

not flagged by urlscan

Netherlands 203.0.113.66AS64512 BulletproofHost BV server nginx 23 requests · 2 domains · 1 IPs · 1 countries scanned 2026-10-18 20:00

title: shopnova-eu.com - Sign in

full urlscan result ↗all scans of shopnova-eu.com ↗

domains contacted by the page (2)

shopnova-eu.com · cdn.mock-static.example

Similar sites 4

Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.

Same page (identical document hash) 4hash:f7a5f16acf2ab1a7fdc32b7ef51bc733432b32f4a09f2faee7f41d473061a0ab

the same HTML served elsewhere — the same phishing kit

Seen	Verdict	Domain		Title
2026-09-20	—	shopn0va.com	urlscan ↗ · VT ↗	shopn0va.com - Sign in
2026-09-19	—	shopnova-login.com	urlscan ↗ · VT ↗	shopnova-login.com - Sign in
2026-09-18	—	secure-shopnova.com	urlscan ↗ · VT ↗	secure-shopnova.com - Sign in
2026-09-12	—	shopnova.co	urlscan ↗ · VT ↗	shopnova.co - Sign in

Same server 0page.ip:203.0.113.66

other pages scanned on the same IP

none

Same brand name 0page.domain:shopnovaisrael

domains containing the brand name

none

Passive DNS replication 1

Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.

Date resolved	Detections (IP)	IP
2026-10-01	3/ 92	203.0.113.171

Subdomains 3

Host	Detections
login.shopnova-eu.com	2/ 92
mail.shopnova-eu.com	0/ 90
www.shopnova-eu.com	0/ 90

Communicating files 0 not fetched yet

Malware samples that contacted this domain while being analysed.

Historical WHOIS · VirusTotal 1

2026-09-18 · Mock Registrar LLC

Registrant Organization: REDACTED FOR PRIVACY
Registrant Country: US
Name Server: NS1.MOCK-DNS.EXAMPLE

Historical certificates 0 VT · 3 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Not before	Names	Issuer
2026-09-30	shopnova-eu.com, www.shopnova-eu.com	C=US, O=Let's Encrypt, CN=R3
2026-09-01	mail0.shopnova-eu.com-cdn.net	Mock CA
2026-09-01	mail1.shopnova-eu.com-cdn.net	Mock CA

Observation timeline

2026-10-14 09:48:39 · HTTP 403 · state new · datacenter · content changed · bd056a8f4f77 · screenshot
2026-10-14 09:52:25 · HTTP 403 · state flagged · datacenter · bd056a8f4f77 · screenshot

first seen 2026-10-14 09:48 · scans 2 · next 2026-10-14 15:52 · candidate state flagged · WHOIS history →

Score history

When	Score	Severity	Confidence	Version
2026-10-14 09:48:39	75	critical	92%	v2-c213b21d+c7
2026-10-14 09:52:26 current	75	critical	92%	v2-c213b21d+c7

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.

Observed (UTC)	Type	Role	Source	SHA-256	Details
2026-10-14 09:52:25	http · residential view	supporting	mock:playwright	bd056a8f4f77932b	probe: residential status: 403 content_sha256: bd056a8f4f77932bd40cad29ca4… +3
2026-10-14 09:52:25	http · referer view	supporting	mock:playwright	bd056a8f4f77932b	probe: referer status: 403 content_sha256: bd056a8f4f77932bd40cad29ca4… +3
2026-10-14 09:52:25	http · param view	supporting	mock:playwright	bd056a8f4f77932b	probe: param status: 403 content_sha256: bd056a8f4f77932bd40cad29ca4… +3
2026-10-14 09:52:25	http · bot view	supporting	mock:playwright	bd056a8f4f77932b	probe: bot status: 403 content_sha256: bd056a8f4f77932bd40cad29ca4… +3
2026-10-14 09:52:25	reputation	contradicting	mock:safebrowsing	—	status: negative
2026-10-14 09:52:25	reputation	context	mock:urlhaus	—	status: unknown
2026-10-14 09:52:25	reputation	contradicting	mock:virustotal	—	status: negative
2026-10-14 09:52:25	whois	primary	mock:rdap	—	status: positive
2026-10-14 09:52:25	html · datacenter view	primary	urlscan	6004976ec5ea76af	title: ShopNova — Sign in forms: 1 snapshot: {"has_dom": true, "reached"…	artifact
2026-10-14 09:52:25	screenshot · datacenter view	primary	urlscan	b3ad05659eee391c	phash: be37c1cd4c483137 dhash: f04f0c396d5c55ab palette: ['#f5f4fb', '#412db1', '#ff… +1	artifact
2026-10-14 09:52:25	ssl	context	mock:playwright	—	fingerprint_sha256: bbbbbbbbbbbbbbbbbbbbbbbbbbb…
2026-10-14 09:52:25	favicon	primary	mock:playwright	ffd6e7f7b2b08577	mmh3: -2029202433 phash: dc966349c3693c96	artifact

show all 28 evidence rows from 2 scan(s)

2026-10-14 09:52:25	http	supporting	mock:playwright	bd056a8f4f77932b	status: 403 final_url: https://shopnova-eu.com/ content_type: text/html; charset=utf-8
2026-10-14 09:52:25	dns	supporting	mock:local_dns	—	status: positive
2026-10-14 09:48:39	http · residential view	supporting	mock:playwright	bd056a8f4f77932b	probe: residential status: 403 content_sha256: bd056a8f4f77932bd40cad29ca4… +3
2026-10-14 09:48:39	http · referer view	supporting	mock:playwright	bd056a8f4f77932b	probe: referer status: 403 content_sha256: bd056a8f4f77932bd40cad29ca4… +3
2026-10-14 09:48:39	http · param view	supporting	mock:playwright	bd056a8f4f77932b	probe: param status: 403 content_sha256: bd056a8f4f77932bd40cad29ca4… +3
2026-10-14 09:48:39	http · bot view	supporting	mock:playwright	bd056a8f4f77932b	probe: bot status: 403 content_sha256: bd056a8f4f77932bd40cad29ca4… +3
2026-10-14 09:48:39	reputation	contradicting	mock:safebrowsing	—	status: negative
2026-10-14 09:48:39	reputation	context	mock:urlhaus	—	status: unknown
2026-10-14 09:48:39	reputation	contradicting	mock:virustotal	—	status: negative
2026-10-14 09:48:39	whois	primary	mock:rdap	—	status: positive
2026-10-14 09:48:39	ssl	context	mock:playwright	—	fingerprint_sha256: bbbbbbbbbbbbbbbbbbbbbbbbbbb…
2026-10-14 09:48:39	html · datacenter view	primary	urlscan	6004976ec5ea76af	title: ShopNova — Sign in forms: 1 snapshot: {"has_dom": true, "reached"…	artifact
2026-10-14 09:48:39	screenshot · datacenter view	primary	urlscan	b3ad05659eee391c	phash: be37c1cd4c483137 dhash: f04f0c396d5c55ab palette: ['#f5f4fb', '#412db1', '#ff… +1	artifact
2026-10-14 09:48:39	favicon	primary	mock:playwright	ffd6e7f7b2b08577	mmh3: -2029202433 phash: dc966349c3693c96	artifact
2026-10-14 09:48:39	http	supporting	mock:playwright	bd056a8f4f77932b	status: 403 final_url: https://shopnova-eu.com/ content_type: text/html; charset=utf-8
2026-10-14 09:48:39	dns	supporting	mock:local_dns	—	status: positive

Advisory opinions · shown for context, never part of the score ⚙ AI advisory · JSON schema

AI · mock:openai phishing impersonating ShopNova · 85% — credential form; lure language; page presents itself as ShopNova

classifier · ml-5edcdd68-20 P(phishing) = 90% (cross-validated accuracy 94%)

shopnova-eu.com

What do I do · review the evidence below, then give a verdict

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

How the score adds up

Group caps ? · stop correlated evidence from double counting

Confidence ? · 92%

Suspect vs. official similarity 100%

Cloaking multi-probe ? ⚙ Tier 3/4 multi-probe

VirusTotal · security vendors

Server reputation · AbuseIPDB

Categories

JARM

Engines flagged first

Look it up elsewhere

Registration data (RDAP)

Registrar & abuse contact

Nameservers

WHOIS history · every WHOIS snapshot WhoisXML has recorded for shopnova-eu.com

First registered

Snapshots

Owners seen

Registrars

Owner details now

TIMELINE

SNAPSHOTS · CHANGED FIELDS MARKED

DNS records source: VirusTotal

HTTPS certificate from VirusTotal

203.0.113.171

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

COMMUNICATING FILES not fetched yet

urlscan.io scan

Similar sites 4

Same page (identical document hash) 4hash:f7a5f16acf2ab1a7fdc32b7ef51bc733432b32f4a09f2faee7f41d473061a0ab

Same server 0page.ip:203.0.113.66

Same brand name 0page.domain:*shopnovaisrael*

Passive DNS replication 1

Subdomains 3

Communicating files 0 not fetched yet

Historical WHOIS · VirusTotal 1

Historical certificates 0 VT · 3 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Observation timeline

Score history

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Advisory opinions · shown for context, never part of the score ⚙ AI advisory · JSON schema

Same brand name 0page.domain:shopnovaisrael