facebook.com/shopnova.support.help
A Facebook page named “ShopNova Support”, created 18 days ago, renamed since, run from VN. It uses the ShopNova · Israel logo, presents itself as ShopNova · Israel's own account, sends people to shopnova-refund.net, and asks for payments, card or order details. The AI read its content: Poses as the brand to collect payments or personal details.
What do I do · review the evidence below, then give a verdict
Several independent signs that this account poses as ShopNova · Israel → confirm, then report the account to Meta (Social account tab).
Notes · for you and the next analyst — kept with the finding, never edited, also in Activity
No notes yet.
Checks · is this ShopNova · Israel? · a separate social score (social-v1-6ace7e14), never mixed with the phishing one
AI: does it pose as ShopNova · Israel? · reads the content · at most 20 of 100 points
Poses as the brand to collect payments or personal details.
- calls itself the brand or its support
- asks people to message it or pay outside the official site
- links to a site that is not the brand's
What the account says · public content, as collected
Report to Meta · the accounts and the impersonation forms
Explain Finding — why it was flagged · every signal, its points and the evidence behind it
| Signal | Group | Points | Evidence |
|---|---|---|---|
| AI: impersonation social_ai_impersonation | AI reading | +20 | the AI read the content: Poses as the brand to collect payments or personal details. |
| claims to be the brand social_claims_official | Identity | +18 | presents itself as the brand's “support” account: ShopNova Support |
| uses the brand's logo social_logo_match | Visual | +18 | its profile picture is the brand's logo (0 bits apart by perceptual hash) |
| links off the brand social_links_off_brand | Behaviour | +15 | sends people to shopnova-refund.net, which is not one of the brand's sites |
| scam lures social_scam_lures | Behaviour | +15 | asks for or offers: “giveaway”, “winner”, “claim”, “refund” |
| new page social_new_account | Freshness | +12 | the page was created 18 day(s) ago |
| renamed page social_renamed | Freshness | +12 | the page changed its name 9 day(s) ago (Meta's page history) |
| run from abroad social_admins_abroad | Infrastructure | +6 | run from VN — the brand operates in IL |
show all 9 signals
| tiny audience social_small_audience | Reputation | +6 | only 340 followers / likes for an account under the brand's name |
How the score adds up
⚙ deterministic · versioned Raw 100 of 100 → normalised to 100 / 100.
Thresholds: Medium 25 · High 50 · Critical 75 · scoring social-v1-6ace7e14
open the arithmetic ↗ — this site's section of the scan trace
Group caps ? · stop correlated evidence from double counting
Confidence ? · 85%
| Breadth (7 independent groups) | +70 |
| Hard confirmers | +0 |
| Evidence completeness | +15 |
| Provider agreement | +0 |
| Unavailable evidence | 0 |
| Single weak signal | 0 |
Suspect vs. official
No screenshot captured (unavailable — not "clean").
Not investigated yet
VirusTotal's verdict from 70+ security vendors, every engine's result and category, and the AbuseIPDB abuse score of each server hosting the site. Google Safe Browsing and URLhaus are already in the header — the scan checks them.
Press Run investigation above: one pass over the APIs, cached for 24 hours.
Look it up elsewhere
Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.
Not investigated yet
RDAP registration and the registrar's abuse contact, the full WHOIS history (every owner, transfer and privacy change — and owner details that were hidden later), DNS records and the HTTPS certificate.
Press Run investigation above: one pass over the APIs, cached for 24 hours.
Not investigated yet
Every server hosting the site with its AbuseIPDB score and every other site on it, the urlscan.io scan with pages that share the same kit, passive DNS, subdomains, historical certificates and malware that contacted the domain.
Press Run investigation above: one pass over the APIs, cached for 24 hours.
Observation timeline
- 2026-10-14 09:48:36 · HTTP — · state new · datacenter · 33bc02aad664
- 2026-10-14 09:52:23 · HTTP — · state flagged · datacenter · 33bc02aad664
first seen 2026-10-14 09:48 · scans 2 · next — · candidate state flagged · WHOIS history →
Score history
| When | Score | Severity | Confidence | Version |
|---|---|---|---|---|
| 2026-10-14 09:48:36 | 100 | critical | 85% | social-v1-6ace7e14 |
| 2026-10-14 09:52:23 current | 100 | critical | 85% | social-v1-6ace7e14 |
Evidence · chain of custody ? ⚙ immutable · DB-enforced
Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.
| Observed (UTC) | Type | Role | Source | SHA-256 | Details | |
|---|---|---|---|---|---|---|
| 2026-10-14 09:52:23 | favicon | context | facebook:profile_picture | ffd6e7f7b2b08577 | phash: dc966349c3693c96 profile_picture: True | artifact |
| 2026-10-14 09:52:23 | http | supporting | searchapi:social | 33bc02aad6641fb6 | status: positive platform: facebook name: ShopNova Support +1 | artifact |
| 2026-10-14 09:48:36 | favicon | context | facebook:profile_picture | ffd6e7f7b2b08577 | phash: dc966349c3693c96 profile_picture: True | artifact |
| 2026-10-14 09:48:36 | http | supporting | searchapi:social | 33bc02aad6641fb6 | status: positive platform: facebook name: ShopNova Support +1 | artifact |