FINDINGS · 8 open
jk move · x select · c confirm · d dismiss · / search ·A finding is a look-alike that scored Medium or higher and waits for an analyst's verdict. Everything below the threshold stays on the Watchlist and is re-checked on a schedule.
| Screenshot | Severity | Host | Score | Conf. | Signals | State | Found | |
|---|---|---|---|---|---|---|---|---|
no screenshot (the page did not load) |
critical AI answer |
shopnova-login.com | 100 | 70 |
a known phishing site sends users elsewhere published by a look-alike | awaiting verdict | ||
no screenshot (the page did not load) |
critical AI answer |
03-9817777 | 100 | 85 |
not on the brand's site a known phishing site published by a look-alike published off the brand's site | awaiting verdict | ||
no screenshot (the page did not load) |
critical social |
facebook.com/shopnova.support.help | 100 | 85 |
AI: impersonation claims to be the brand uses the brand's logo links off the brand +5 more | awaiting verdict | ||
no screenshot (the page did not load) |
critical social |
facebook.com/shopnova.support.help | 100 | 85 |
AI: impersonation claims to be the brand uses the brand's logo links off the brand +5 more | awaiting verdict | ||
![]() |
critical CLOAKED KIT |
shopnova-refund.net | 89 VT — | 100 |
identical favicon looks like the real site shares a server with phishing linked to a mapped attacker +11 more | awaiting verdict | ||
no screenshot (the page did not load) |
critical social |
instagram.com/shopnova.israel.official | 86 | 80 |
AI: impersonation claims to be the brand uses the brand's logo links off the brand +1 more | awaiting verdict | ||
![]() |
critical CLOAKED KIT |
shopnova-eu.com | 75 VT clean | 92 |
identical favicon looks like the real site asks for a password brand name in the domain +10 more | awaiting verdict | ||
no screenshot (the page did not load) |
high AI answer |
help@shopnova-care.net | 70 | 75 |
not on the brand's site the cited page does not say it the AI took it back | awaiting verdict |
8 in total
Statistics · across open findings of the chosen brand
show ▾hide ▴
Open by severity · Medium ≥ 25 · High ≥ 50 · Critical ≥ 75
critical7
high1
Why things are flagged · signals fired per group across open findings
Risk score distribution
0
10
420
130
40
450
260
770
1380
590
New findings · 14 days
14 days agotoday · 0
Surface · where the brand appears: domain name · subdomain · URL path
■ domain name 25 ■ content 7 ■ URL path 4
Top fired signals
page title claims the brand
21
brand words in the text
21
brand name in the domain
18
brand + extra word
17
urgent lure wording
17
registered < 30 days ago
17
identical favicon
17
cloned login form
16
asks for a password
16
looks like the real site
15
Every signal belongs to one of 7 groups, and each group has a points cap so correlated evidence is not counted twice. Hover a signal for its evidence and points. How scoring works →
Keyboard shortcuts
| j / k | next / previous finding |
| Enter | open the highlighted finding |
| x | select / unselect it |
| c | confirm the selected (or highlighted) findings as phishing |
| d | dismiss them — the bar asks for the reason |
| / | search by host |
| s | show / hide the statistics |
| ? | this sheet · Esc closes it |

