FINDINGS · 39 confirmed phishing
jk move · x select · c confirm · d dismiss · / search ·A finding is a look-alike that scored Medium or higher and waits for an analyst's verdict. Everything below the threshold stays on the Watchlist and is re-checked on a schedule.
| Screenshot | Severity | Host | Score | Conf. | Signals | State | Found | |
|---|---|---|---|---|---|---|---|---|
 |
critical CLOAKED KIT |
shopnova-verification.com ShopNova | 92 VT — | 100 |
identical favicon hides from scanners looks like the real site shares a server with phishing +10 more | confirmed phishing | ||
 |
critical | vaultpay-login.com VaultPay | 87 VT 7 | 100 |
identical favicon looks like the real site shares a server with phishing already flagged as phishing +15 more | confirmed phishing | ||
 |
critical CLOAKED KIT |
shopnova-giftcard.com ShopNova | 87 VT — | 100 |
hides from datacenter IPs identical favicon looks like the real site asks for a password +9 more | confirmed phishing | ||
no screenshot (the page did not load) |
critical social |
instagram.com/shopnova.israel.official ShopNova · Israel | 86 | 80 |
AI: impersonation claims to be the brand uses the brand's logo links off the brand +1 more | confirmed phishing | ||
 |
critical | shopn0va.com ShopNova | 85 VT 7 | 100 |
identical favicon looks like the real site shares a server with phishing linked to a mapped attacker +13 more | confirmed phishing | ||
 |
critical shop · likely fake |
runnerhub-sale.com ShopNova | 85 VT — | 90 |
company number not in the registry half the official price or less reviews say scam / replica Gmail-type contact only +4 more | confirmed phishing | ||
 |
critical shop · likely fake |
onestyle-shopping.com ShopNova | 85 VT — | 90 |
company number not in the registry half the official price or less reviews say scam / replica Gmail-type contact only +6 more | confirmed phishing | ||
 |
critical | secure-shopnova.com ShopNova | 83 VT — | 100 |
identical favicon looks like the real site shares a server with phishing linked to a mapped attacker +13 more | confirmed phishing | ||
 |
critical | secure-shopnova.com ShopNova | 83 VT — | 100 |
identical favicon looks like the real site shares a server with phishing linked to a mapped attacker +13 more | confirmed phishing | ||
 |
critical shop · likely fake |
stepcloud-store.com ShopNova | 82 VT — | 90 |
half the official price or less ad page uses the brand's name reviews say scam / replica Gmail-type contact only +4 more | confirmed phishing | ||
 |
critical | shopnova.co ShopNova | 81 VT — | 100 |
identical favicon brand on another TLD looks like the real site shares a server with phishing +11 more | confirmed phishing | ||
 |
critical | shopnova-support-center.com ShopNova | 81 VT — | 100 |
identical favicon shares a server with phishing linked to a mapped attacker asks for a password +7 more | confirmed phishing | ||
 |
critical | shopnova-login.com ShopNova | 81 VT — | 100 |
identical favicon looks like the real site shares a server with phishing linked to a mapped attacker +13 more | confirmed phishing | ||
 |
critical | vaultpay-verify.com VaultPay | 77 VT — | 100 |
identical favicon looks like the real site shares a server with phishing linked to a mapped attacker +12 more | confirmed phishing | ||
 |
critical | vaultpay-secure.net VaultPay | 77 VT — | 90 |
identical favicon looks like the real site shares a server with phishing same tracking ID as phishing +11 more | confirmed phishing | ||
 |
critical | vault-pay.co VaultPay | 75 VT — | 90 |
identical favicon looks like the real site shares a server with phishing same tracking ID as phishing +10 more | confirmed phishing | ||
 |
critical | coinpilot-bot.io CoinPilot | 75 VT — | 90 |
forwards with an affiliate id identical favicon forwards through another host looks like the real site +8 more | confirmed phishing | ||
 |
critical | coin-pilot.io CoinPilot | 75 VT 7 | 100 |
forwards with an affiliate id identical favicon forwards through another host looks like the real site +9 more | confirmed phishing | ||
 |
critical | cooinpilot.io CoinPilot | 75 VT — | 100 |
forwards with an affiliate id identical favicon forwards through another host looks like the real site +8 more | confirmed phishing | ||
 |
critical | koinpilot.io CoinPilot | 75 VT — | 100 |
forwards with an affiliate id identical favicon forwards through another host looks like the real site +8 more | confirmed phishing | ||
 |
critical | coinplot.io CoinPilot | 75 VT 7 | 100 |
forwards with an affiliate id identical favicon forwards through another host looks like the real site +9 more | confirmed phishing | ||
 |
critical | coinpllot.io CoinPilot | 75 VT — | 100 |
forwards with an affiliate id identical favicon forwards through another host looks like the real site +8 more | confirmed phishing | ||
 |
critical | coinpilott.io CoinPilot | 75 VT — | 100 |
forwards with an affiliate id identical favicon forwards through another host looks like the real site +9 more | confirmed phishing | ||
 |
critical | shopnovа.com homoglyph ShopNova | 75 VT — | 90 |
identical favicon looks like the real site asks for a password cloned login form +7 more | confirmed phishing | ||
 |
critical | shoqnova.com ShopNova | 75 VT — | 100 |
identical favicon looks like the real site shares a server with phishing asks for a password +8 more | confirmed phishing | ||
 |
critical | shopnowa.com ShopNova | 75 VT — | 100 |
identical favicon looks like the real site shares a server with phishing asks for a password +8 more | confirmed phishing | ||
 |
critical CLOAKED KIT |
shopnova-refund.net ShopNova | 75 VT — | 100 |
identical favicon looks like the real site asks for a password brand name in the domain +8 more | confirmed phishing | ||
 |
high shop · likely fake |
footstyle-il.com ShopNova | 70 VT — | 90 |
half the official price or less Gmail-type contact only new domain no privacy / terms / returns +4 more | confirmed phishing | ||
 |
high | shopnova-account.net ShopNova | 68 VT 7 | 100 |
looks like the real site asks for a password brand name in the domain cloned login form +8 more | confirmed phishing | ||
 |
high | shopnova-verify.com ShopNova | 68 VT — | 100 |
looks like the real site asks for a password brand name in the domain cloned login form +8 more | confirmed phishing | ||
 |
high shop · likely fake |
stylehub-israel.com ShopNova | 57 VT — | 90 |
half the official price or less Gmail-type contact only one price, many premium brands no footprint on Google +3 more | confirmed phishing | ||
 |
high shop · likely fake |
kicksmart-il.co.il ShopNova | 53 VT — | 80 |
company dissolved half the official price or less new domain no footprint on Google | confirmed phishing | ||
Kaspersky shows its phishing warning instead of the site |
high | shopnova-id-check.com ShopNova · Israel | 50 VT clean | 100 |
already flagged as phishing linked to a mapped attacker brand name in the domain registered < 7 days ago +3 more | confirmed phishing | ||
 |
high | shopnova--sneakers.com ShopNova | 50 VT 7 | 100 |
Cloudflare blocks it as phishing brand name in the domain asks for card details flagged on VirusTotal +3 more | confirmed phishing | ||
 |
medium shop · suspicious |
shopnova-outlet-store.com ShopNova | 32 VT — | 65 |
no privacy / terms / returns no company details no footprint on Google | confirmed phishing | ||
 |
medium | shopnova-press.com ShopNova | 29 VT — | 80 |
identical favicon brand name in the domain page title claims the brand brand + extra word +1 more | confirmed phishing | ||
 |
medium | shopnova-status.com ShopNova | 29 VT — | 80 |
identical favicon brand name in the domain page title claims the brand brand + extra word +1 more | confirmed phishing | ||
 |
medium | shopnova-careers.com ShopNova | 29 VT — | 80 |
identical favicon brand name in the domain page title claims the brand brand + extra word +1 more | confirmed phishing | ||
 |
medium | shopnova-coupons.com ShopNova | 28 VT — | 50 |
brand name in the domain page title claims the brand brand + extra word brand words in the text +1 more | confirmed phishing |
39 in total
Statistics · across open findings
show ▾hide ▴
Open by severity · Medium ≥ 25 · High ≥ 50 · Critical ≥ 75
critical8
high1
Why things are flagged · signals fired per group across open findings
Risk score distribution
0
10
420
130
40
450
260
1870
1480
590
New findings · 14 days
14 days agotoday · 0
Surface · where the brand appears: domain name · subdomain · URL path
■ domain name 37 ■ content 7 ■ URL path 4
Top fired signals
brand words in the text
33
identical favicon
29
cloned login form
28
asks for a password
28
looks like the real site
27
same colours
27
page title claims the brand
26
brand name in the domain
23
brand + extra word
22
urgent lure wording
22
Every signal belongs to one of 7 groups, and each group has a points cap so correlated evidence is not counted twice. Hover a signal for its evidence and points. How scoring works →
Keyboard shortcuts
| j / k | next / previous finding |
| Enter | open the highlighted finding |
| x | select / unselect it |
| c | confirm the selected (or highlighted) findings as phishing |
| d | dismiss them — the bar asks for the reason |
| / | search by host |
| s | show / hide the statistics |
| ? | this sheet · Esc closes it |