82
risk ?
stepcloud-store.com
A .com shop in Hebrew advertising ShopNova products on Facebook / Instagram (page “ShopNova Outlet IL” — a page named after the brand that is not the brand's own) at 349 ILS per item — 44% of the official 799 ILS. Its only e-mail is Gmail (stepcloud.store@gmail.com), it has no privacy policy, terms or returns page and it names no company at all. Search results about it mention scams or replica products.
found by Facebook / Instagram ads
confidence ?90%
domain name · https://stepcloud-store.com/
hosted 
198.51.100.44
registrar Mock Registrar LLC
198.51.100.44
registrar Mock Registrar LLC
THREAT INTEL · what public blocklists say about this site — each card opens the lookup
VirusTotal↗
not in VirusTotal yet (unknown ≠ clean)
Google Safe Browsing↗
not on Google's list yet — browsers do not warn
Not on public blocklists yet — they lag by hours or days. BrandWatch found it first; unknown is never treated as safe.
What do I do · get it taken down
✓ Confirmed · Likely counterfeit seller ·
by admin
change the conclusion
Attack infrastructure:
mapped → open the map
Notes · for you and the next analyst — kept with the finding, never edited, also in Activity
No notes yet.
Conclusion · how sure are we that it sells fakes? — every letter and report claims only this
1 · Suspicious shopsigns that justify a closer look — not proof that the goods are fake
2 · Likely counterfeit sellerindependent evidence about the goods and about the seller point to counterfeits
the analyst’s conclusion
3 · Confirmed counterfeitdirect proof: a test purchase, the brand's inspection of the product, or a platform's confirmation
BrandWatch reads “Likely counterfeit seller” because: the price is half the official price or less · reviews say the goods are fake · reviews report a scam or orders that never arrived · the seller is anonymous — no company details, or nothing about it on Google · a one-brand store or an ad page that uses the brand's name.
What would move it up:
- for “Confirmed counterfeit”: a test purchase, the brand's inspection of the product, or a platform's confirmation
Concluded by admin · 2026-10-14 09:50
Shop checks · is this a real seller of ShopNova products? · separate from the phishing score (shop-v2-d92668ce)
✓
About ShopNova
the page names “shopnova”
✕
The ad page uses the brand’s name
the Facebook / Instagram page running the ads, “ShopNova Outlet IL”, carries the brand's name but is not the brand's own page
–
Company number
no company number on the page — not checked is never “valid”
✕
No privacy, terms or returns page
a real shop links them from every page
✕
Free-mail contact only
stepcloud.store@gmail.com
✕
No company details
no company name or registration number on the page
✕
Half the official price or less
349 ILS per item (₪349) — 44% of the official 799 ILS (ShopNova Runner)
✓
Old domain
the domain is 3 years old
✕
Local language, generic domain
a .com site written in he — a local shop without the country's domain ending
✕
No footprint on Google
Google finds nothing about “stepcloud-store.com” outside the shop itself
✕
Reviews mention scam / replica
a search result about the shop mentions “רפליקה”: stepcloud-store.com — נעליים מזויפות
search results about the shop (1)
- stepcloud-store.com — נעליים מזויפות — הגיעה רפליקה, לא מחזירים כסף.
AI: is this shop legitimate? · advisory, never part of the score
LIKELY SCAM
95% · mock:openai · likely sells replicas
- no privacy policy, terms or returns page linked from the shop's page
- the only contact e-mail is a free mailbox (stepcloud.store@gmail.com)
- no company name or registration number anywhere on the page
- a .com site written in he — a local shop without the country's domain ending
- the Facebook / Instagram page running the ads, “ShopNova Outlet IL”, carries the brand's name but is not the brand's own page
- 349 ILS per item (₪349) — 44% of the official 799 ILS (ShopNova Runner)
reviews mention fake or replica products
Where it was found
Country IL · page language he · built on Shopify
1 Meta ad(s) send buyers here — see Report to Meta below.
Report to Meta · the ads and the pages that send buyers to this shop
Explain Finding — why it was flagged · every signal, its points and the evidence behind it
| Signal | Group | Points | Evidence |
|---|---|---|---|
| half the official price or less shop_price_far_below_official | Offer | +20 | 349 ILS per item (₪349) — 44% of the official 799 ILS (ShopNova Runner) |
| ad page uses the brand's name shop_ad_page_uses_brand | Brand use | +15 | the Facebook / Instagram page running the ads, “ShopNova Outlet IL”, carries the brand's name but is not the brand's own page |
| reviews say scam / replica shop_reviews_warn | Reputation | +15 | a search result about the shop mentions “רפליקה”: stepcloud-store.com — נעליים מזויפות |
| Gmail-type contact only shop_free_email_only | Contact & policies | +12 | the only contact e-mail is a free mailbox (stepcloud.store@gmail.com) |
| no privacy / terms / returns shop_no_policy_pages | Contact & policies | +12 | no privacy policy, terms or returns page linked from the shop's page |
| no company details shop_no_company_details | Seller | +10 | no company name or registration number anywhere on the page |
| no footprint on Google shop_no_web_presence | Seller | +10 | Google finds nothing about “stepcloud-store.com” outside the shop itself |
| local language, generic domain shop_tld_language_mismatch | Seller | +6 | a .com site written in he — a local shop without the country's domain ending |
show all 8 signals and false-positive checks
| the shop's domain is more than three years old shop_established_domain | false-positive check | -8 | lowers the score: a sign the site may be legitimate |
How the score adds up
⚙ deterministic · versioned Raw 82 of 100 → normalised to 82 / 100.
Thresholds: Medium 25 · High 50 · Critical 75 · scoring shop-v2-d92668ce
open the arithmetic ↗ — this site's section of the scan trace
Group caps ? · stop correlated evidence from double counting
Contact & policies
24 → 15
Seller
26 → 25
Brand use
15 / 15
Offer
20 / 22
Reputation
15 / 15
Confidence ? · 90%
| Breadth (5 independent groups) | +70 |
| Hard confirmers | +0 |
| Evidence completeness | +20 |
| Provider agreement | +0 |
| Unavailable evidence | 0 |
| Single weak signal | 0 |
Suspect vs. official similarity 59%
stepcloud-store.com
the real ShopNova ?
0
VirusTotal · security vendors
0 of 90 engines flag this domain
malicious 0 · suspicious 0 · community reputation 0
Server reputation · AbuseIPDB
25 or more = several defenders reported abuse from this server.
Categories
uncategorized Mock Category Service
JARM
ba6266ff901a72da657c69050b7c3f721725851d8b77e5428366ef6cabf5eb
Engines flagged first
| Engine | Category | Result | Method |
|---|---|---|---|
| BitDefender | harmless | clean | blacklist |
| CRDF | harmless | clean | blacklist |
| ESET | harmless | clean | blacklist |
| Fortinet | harmless | clean | blacklist |
| Google Safebrowsing | harmless | clean | blacklist |
| Kaspersky | harmless | clean | blacklist |
| Netcraft | harmless | clean | blacklist |
| OpenPhish | harmless | clean | blacklist |
| Phishtank | harmless | clean | blacklist |
| Quttera | harmless | clean | blacklist |
| Sophos | harmless | clean | blacklist |
| Webroot | harmless | clean | blacklist |
Look it up elsewhere
Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.
Registration data (RDAP)
- Name
- stepcloud-store.com
- registration
- 2023-03-24
- Status
- —
- DNSSEC
- —
Registrar & abuse contact
- Registrar
- Mock Registrar LLC
- Abuse email
- —
- registrant org
- REDACTED FOR PRIVACY
Nameservers
—Current WHOIS record (VirusTotal)
Domain Name: STEPCLOUD-STORE.COM
Registrar: Mock Registrar LLC
Registrar Abuse Contact Email: abuse@mock-registrar.example
Creation Date: 2023-03-24T00:00:00Z
Name Server: NS1.MOCK-DNS.EXAMPLE
Registrant Country: US
WHOIS history · every WHOIS snapshot WhoisXML has recorded for stepcloud-store.com
Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.
First registered
2023-03-24
Mock Registrar LLC
Snapshots
1
2023-03-25 → 2023-03-25
Owners seen
0 visible
0 owner change(s)
Registrars
1
0 transfer(s) · Mock Registrar LLC
Owner details now
Hidden
privacy since registration
TIMELINE
- 2023-03-24Registered with privacy onregistrant shown as 'REDACTED FOR PRIVACY' · via Mock Registrar LLC · first WHOIS snapshot 2023-03-25
SNAPSHOTS · CHANGED FIELDS MARKED
| Seen | Registrar | Registrant | Created · expires |
|---|---|---|---|
| 2023-03-25 | Mock Registrar LLC | hidden · REDACTED FOR PRIVACY | 2023-03-24 · 2027-03-23 |
raw WHOIS · 2023-03-25Domain Name: STEPCLOUD-STORE.COM
Registrar: Mock Registrar LLC
Creation Date: 2023-03-24T00:00:00Z
Updated Date: 2023-03-25T00:00:00Z
Registry Expiry Date: 2027-03-23T00:00:00Z
Registrant Organization: REDACTED FOR PRIVACY
Registrant Name:
Registrant Email:
Name Server: NS1.MOCK-DNS.EXAMPLE
Name Server: NS2.MOCK-DNS.EXAMPLE | |||
Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .
DNS records source: VirusTotal
A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).
| Type | TTL | Value |
|---|---|---|
| A | 300 | 198.51.100.44 |
| AAAA | 300 | 2001:db8::80e9 |
| NS | 21600 | ns1.mock-dns.example |
| NS | 21600 | ns2.mock-dns.example |
| MX | 3600 | mail.stepcloud-store.com prio 10 |
| SOA | 1800 | ns1.mock-dns.example rname hostmaster.stepcloud-store.com · serial 2026100801 |
HTTPS certificate from VirusTotal
- Common name
- stepcloud-store.com
- Issuer
- C=US O=Mock Trust Services CN=MT1
- Valid
- 2026-09-20 00:00:00 → 2026-12-19 00:00:0032% of the validity period elapsed
- Alt names (2)
- stepcloud-store.com www.stepcloud-store.com
- SHA-256
- 560a2dae68f045614b7c27d75e3edc8bc693033094074859e471bd1bed330153 · crt.sh ↗
serial, signature, key, TLS and the full certificate
- Subject
- CN=stepcloud-store.com
- Serial
- f92987bf
- Signature
- sha256ECDSA
- Public key
- EC secp256r1
- SHA-1
- 2ce1077473051f94bb630192aad4e2adb4772ad2
{
"cert_signature": {
"signature_algorithm": "sha256ECDSA"
},
"extensions": {
"subject_alternative_name": [
"stepcloud-store.com",
"www.stepcloud-store.com"
]
},
"issuer": {
"C": "US",
"CN": "MT1",
"O": "Mock Trust Services"
},
"public_key": {
"algorithm": "EC",
"ec": {
"oid": "secp256r1"
}
},
"serial_number": "f92987bf",
"subject": {
"CN": "stepcloud-store.com"
},
"thumbprint": "2ce1077473051f94bb630192aad4e2adb4772ad2",
"thumbprint_sha256": "560a2dae68f045614b7c27d75e3edc8bc693033094074859e471bd1bed330153",
"validity": {
"not_after": "2026-12-19 00:00:00",
"not_before": "2026-09-20 00:00:00"
},
"version": "V3"
}
0
198.51.100.44
India · Mumbai · AS64564 · Mock Hosting LLC · 198.51.100.0/24 · RIPE NCC
0 of 94 engines flag this IP
· 5 sites hosted, 2 flagged · 0 communicating files
Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days
0/ 100
No reports in the last 90 days
Data Center/Web Hosting/Transit · Mock Hosting LLC
A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.
SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)
COMMUNICATING FILES not fetched yet
IP WHOIS record
inetnum: 198.51.100.0 - 198.51.100.255
org-name: Mock Hosting LLC
abuse-mailbox: abuse@mock.example
engine verdicts for this IP (12)
| Engine | Category | Result |
|---|---|---|
| BitDefender | harmless | clean |
| CRDF | harmless | clean |
| ESET | harmless | clean |
| Fortinet | harmless | clean |
| Google Safebrowsing | harmless | clean |
| Kaspersky | harmless | clean |
| Netcraft | harmless | clean |
| OpenPhish | harmless | clean |
| Phishtank | harmless | clean |
| Quttera | harmless | clean |
| Sophos | harmless | clean |
| Webroot | harmless | clean |
urlscan.io scan
not flagged by urlscan
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-14 09:50
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-14 09:50
title: stepcloud-store.com - Sign in
domains contacted by the page (2)
stepcloud-store.com · cdn.mock-static.example
Similar sites 30
Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.
Same page (identical document hash) 4hash:4182e50a645c525943b3a1ec3bd9f06fc34a5863eac76cc5aad3fb10fc45bb5c
the same HTML served elsewhere — the same phishing kit
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-09-16 | — | shopn0va.com |
urlscan ↗ · VT ↗ | shopn0va.com - Sign in |
| 2026-09-15 | — | shopnova-login.com |
urlscan ↗ · VT ↗ | shopnova-login.com - Sign in |
| 2026-09-14 | — | secure-shopnova.com |
urlscan ↗ · VT ↗ | secure-shopnova.com - Sign in |
| 2026-09-08 | — | shopnova.co |
urlscan ↗ · VT ↗ | shopnova.co - Sign in |
Same server 0page.ip:203.0.113.66
other pages scanned on the same IP
noneSame brand name 26page.domain:*shopnova*
domains containing the brand name
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-10-14 | — | shopnova-partners.com |
urlscan ↗ · VT ↗ | shopnova-partners.com - Sign in |
| 2026-10-13 | — | shopnova-blog.net |
urlscan ↗ · VT ↗ | shopnova-blog.net - Sign in |
| 2026-10-12 | — | shopnovafans.com |
urlscan ↗ · VT ↗ | shopnovafans.com - Sign in |
| 2026-10-11 | — | shopnova-reviews.com |
urlscan ↗ · VT ↗ | shopnova-reviews.com - Sign in |
| 2026-10-10 | — | shopnova-careers.com |
urlscan ↗ · VT ↗ | shopnova-careers.com - Sign in |
| 2026-10-09 | — | shopnova-deals.com |
urlscan ↗ · VT ↗ | shopnova-deals.com - Sign in |
| 2026-10-08 | — | shopnova-status.com |
urlscan ↗ · VT ↗ | shopnova-status.com - Sign in |
| 2026-10-07 | — | shopnova-community.org |
urlscan ↗ · VT ↗ | shopnova-community.org - Sign in |
| 2026-10-06 | — | shopnova-press.com |
urlscan ↗ · VT ↗ | shopnova-press.com - Sign in |
| 2026-10-05 | — | shopnova-events.com |
urlscan ↗ · VT ↗ | shopnova-events.com - Sign in |
| 2026-09-24 | — | shopnova.com |
urlscan ↗ · VT ↗ | shopnova.com - Sign in |
| 2026-09-23 | — | www.shopnova.com |
urlscan ↗ · VT ↗ | www.shopnova.com - Sign in |
| 2026-09-22 | — | shopnova.co.il |
urlscan ↗ · VT ↗ | shopnova.co.il - Sign in |
| 2026-09-13 | — | shopnova-verify.com |
urlscan ↗ · VT ↗ | shopnova-verify.com - Sign in |
| 2026-09-10 | — | shopnova-account.net |
urlscan ↗ · VT ↗ | shopnova-account.net - Sign in |
| 2026-09-09 | — | shopnova-support-center.com |
urlscan ↗ · VT ↗ | shopnova-support-center.com - Sign in |
| 2026-09-06 | — | shopnova-giftcard.com |
urlscan ↗ · VT ↗ | shopnova-giftcard.com - Sign in |
| 2026-09-05 | — | shopnova-refund.net |
urlscan ↗ · VT ↗ | shopnova-refund.net - Sign in |
| 2026-09-04 | — | shopnova-verification.com |
urlscan ↗ · VT ↗ | shopnova-verification.com - Sign in |
| 2026-09-03 | — | shopnova--sneakers.com |
urlscan ↗ · VT ↗ | shopnova--sneakers.com - Sign in |
| 2026-09-02 | — | shopnova-eu.com |
urlscan ↗ · VT ↗ | shopnova-eu.com - Sign in |
| 2026-09-01 | — | shopnova-id-check.com |
urlscan ↗ · VT ↗ | shopnova-id-check.com - Sign in |
| 2026-08-20 | — | shopnova-support.com |
urlscan ↗ · VT ↗ | shopnova-support.com - Sign in |
| 2026-08-19 | — | shopnova-review.com |
urlscan ↗ · VT ↗ | shopnova-review.com - Sign in |
| 2026-08-18 | — | shopnova-coupons.com |
urlscan ↗ · VT ↗ | shopnova-coupons.com - Sign in |
Passive DNS replication 1
Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.
| Date resolved | Detections (IP) | IP |
|---|---|---|
| 2026-09-27 | 3/ 92 | 198.51.100.44 |
Subdomains 3
| Host | Detections |
|---|---|
| login.stepcloud-store.com | 2/ 92 |
| mail.stepcloud-store.com | 0/ 90 |
| www.stepcloud-store.com | 0/ 90 |
Communicating files 0 not fetched yet
Malware samples that contacted this domain while being analysed.
Historical WHOIS · VirusTotal 1
2026-09-14 · Mock Registrar LLC
- Registrant Organization
- REDACTED FOR PRIVACY
- Registrant Country
- US
- Name Server
- NS1.MOCK-DNS.EXAMPLE
Historical certificates 0 VT · 2 CT not fetched yet
CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains
| Not before | Names | Issuer |
|---|---|---|
| 2026-09-30 | stepcloud-store.com, www.stepcloud-store.com | C=US, O=Let's Encrypt, CN=R3 |
| 2026-09-01 | mail0.stepcloud-store.com-cdn.net | Mock CA |
Observation timeline
- 2026-10-12 06:41:47 · HTTP 200 · state new · datacenter · content changed · 32948f6a4ef0 · screenshot
- 2026-10-12 06:46:00 · HTTP 200 · state flagged · datacenter · 32948f6a4ef0 · screenshot
first seen 2026-10-12 06:41 · scans 2 · next 2026-10-12 12:46 · candidate state flagged · WHOIS history →
Score history
| When | Score | Severity | Confidence | Version |
|---|---|---|---|---|
| 2026-10-12 06:41:47 | 82 | critical | 90% | shop-v2-d92668ce |
| 2026-10-12 06:46:01 current | 82 | critical | 90% | shop-v2-d92668ce |
Evidence · chain of custody ? ⚙ immutable · DB-enforced
Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.
| Observed (UTC) | Type | Role | Source | SHA-256 | Details | |
|---|---|---|---|---|---|---|
| 2026-10-12 06:46:00 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:46:00 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:46:00 | reputation | context | mock:virustotal | — | status: unknown | |
| 2026-10-12 06:46:00 | whois | context | mock:rdap | — | status: positive | |
| 2026-10-12 06:46:00 | favicon | context | mock:playwright | 15e4776eac3c03a9 | mmh3: 2097281101 phash: ad5a4aa55a6a5aa5 | artifact |
| 2026-10-12 06:46:00 | screenshot · datacenter view | context | mock:playwright | 769a683826da9aa6 | phash: a602097d585d3fcd dhash: 8dcc6cada56e2632 palette: ['#3a4b6c', '#788582', '#2e… | artifact |
| 2026-10-12 06:46:00 | html · datacenter view | primary | mock:playwright | 32948f6a4ef035ad | title: STEP CLOUD — ShopNova Runner forms: 0 parked: False | artifact |
| 2026-10-12 06:46:00 | http | supporting | mock:playwright | 32948f6a4ef035ad | status: 200 final_url: https://stepcloud-store.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-12 06:46:00 | dns | supporting | mock:local_dns | — | status: positive | |
| 2026-10-12 06:41:47 | reputation | contradicting | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:41:47 | reputation | context | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:41:47 | reputation | context | mock:virustotal | — | status: unknown |
show all 18 evidence rows from 2 scan(s)
| 2026-10-12 06:41:47 | whois | context | mock:rdap | — | status: positive | |
| 2026-10-12 06:41:47 | favicon | context | mock:playwright | 15e4776eac3c03a9 | mmh3: 2097281101 phash: ad5a4aa55a6a5aa5 | artifact |
| 2026-10-12 06:41:47 | screenshot · datacenter view | context | mock:playwright | 769a683826da9aa6 | phash: a602097d585d3fcd dhash: 8dcc6cada56e2632 palette: ['#3a4b6c', '#788582', '#2e… | artifact |
| 2026-10-12 06:41:47 | html · datacenter view | primary | mock:playwright | 32948f6a4ef035ad | title: STEP CLOUD — ShopNova Runner forms: 0 parked: False | artifact |
| 2026-10-12 06:41:47 | http | supporting | mock:playwright | 32948f6a4ef035ad | status: 200 final_url: https://stepcloud-store.com/ content_type: text/html; charset=utf-8 | |
| 2026-10-12 06:41:47 | dns | supporting | mock:local_dns | — | status: positive |