risk ?

critical likely counterfeit seller confirmed · likely fake brand ShopNova

runnerhub-sale.com

Registered 12 days ago. A .com shop advertising ShopNova products on Facebook / Instagram (page “RunnerHub Deals”) at 50 USD per item — 33% of the official 150 USD. Its only e-mail is Outlook (support.runnerhub@outlook.com), it has no privacy policy, terms or returns page and company number 88812345 does not exist in OpenCorporates (recorded). Search results about it mention scams or replica products.

found by Facebook / Instagram ads confidence ?90% domain name · https://runnerhub-sale.com/ hosted

198.51.100.42 registrar Mock Registrar LLC

THREAT INTEL · what public blocklists say about this site — each card opens the lookup

VirusTotal↗

not in VirusTotal yet (unknown ≠ clean)

Google Safe Browsing↗

not on Google's list yet — browsers do not warn

Not on public blocklists yet — they lag by hours or days. BrandWatch found it first; unknown is never treated as safe.

What do I do · get it taken down

✓ Confirmed · Likely counterfeit seller · 2026-10-14 09:50

by admin

change the conclusion

Attack infrastructure: mapped → open the map

domain timeline evidence packages:json · 2026-10-14 09:50 html · 2026-10-14 09:50

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

No notes yet.

Conclusion · how sure are we that it sells fakes? — every letter and report claims only this

1 · Suspicious shopsigns that justify a closer look — not proof that the goods are fake

2 · Likely counterfeit sellerindependent evidence about the goods and about the seller point to counterfeits the analyst’s conclusion

3 · Confirmed counterfeitdirect proof: a test purchase, the brand's inspection of the product, or a platform's confirmation

BrandWatch reads “Likely counterfeit seller” because: the price is half the official price or less · reviews say the goods are fake · reviews report a scam or orders that never arrived · the company is not in the registry, is dissolved, or is another business · the seller is anonymous — no company details, or nothing about it on Google.

What would move it up:

for “Confirmed counterfeit”: a test purchase, the brand's inspection of the product, or a platform's confirmation

Concluded by admin · 2026-10-14 09:50

Shop checks · is this a real seller of ShopNova products? · separate from the phishing score (shop-v2-d92668ce)

✓

About ShopNova

the page names “shopnova”

Company number not in the registry

88812345 (Company No.) does not exist in OpenCorporates (recorded)

open the registry ↗

No privacy, terms or returns page

a real shop links them from every page

Free-mail contact only

support.runnerhub@outlook.com

✓

Company details on the page

88812345

Half the official price or less

50 USD per item (⁨ner — Clearance Buy 2 pairs for $99! Free shi⁩) — 33% of the official 150 USD (ShopNova Runner)

Multi-buy offer

multi-buy offer: “⁨ner — Clearance Buy 2 pairs for $99! Free shi⁩”

New domain

domain registered 12 day(s) ago

No footprint on Google

Google finds nothing about “88812345” outside the shop itself

Reviews mention scam / replica

a search result about the shop mentions “⁨scam⁩”: ⁨runnerhub-sale.com reviews⁩

search results about the shop (1)

runnerhub-sale.com reviews — Never arrived. Paid $99, tracking number fake. Scam.

AI: is this shop legitimate? · advisory, never part of the score

LIKELY SCAM

95% · mock:openai · likely sells replicas

no privacy policy, terms or returns page linked from the shop's page
the only contact e-mail is a free mailbox (support.runnerhub@outlook.com)
multi-buy offer: “⁨ner — Clearance Buy 2 pairs for $99! Free shi⁩”
domain registered 12 day(s) ago
50 USD per item (⁨ner — Clearance Buy 2 pairs for $99! Free shi⁩) — 33% of the official 150 USD (ShopNova Runner)
company number 88812345 (Company No.) does not exist in OpenCorporates (recorded)

reviews mention fake or replica products

Where it was found

Country US · page language en · built on Shopify

1 Meta ad(s) send buyers here — see Report to Meta below.

Report to Meta · the ads and the pages that send buyers to this shop

Meta's own “Report ad” and “Report Page” flows work for anyone with a Facebook account. BrandWatch prepares the links and the text; a person files the report. Draft a takedown to keep track of what was reported.

RunnerHub Deals 1 adalso on Instagram

Open the page ↗

Report the page: open it → “…” → Report Page → Scam / fraud or Pretending to be a business.

“ShopNova Runner clearance 🏃 Buy 2 pairs for $99 — today only!”

US · running since 2026-10-06 · facebook, instagram · ad 757455003018522

Report this ad ↗

Report an ad: open it in the Ad Library → “…” → Report ad → Scam or fraud (or Intellectual property → Counterfeit, if you hold the trademark).

Text to paste into the report

This ad / page sends buyers to https://runnerhub-sale.com/, a shop that is likely selling counterfeit ShopNova products. It is not an authorised ShopNova retailer.
Registered 12 days ago. A .com shop advertising ShopNova products on Facebook / Instagram (page “RunnerHub Deals”) at 50 USD per item — 33% of the official 150 USD. Its only e-mail is Outlook (support.runnerhub@outlook.com), it has no privacy policy, terms or returns page and company number 88812345 does not exist in OpenCorporates (recorded). Search results about it mention scams or replica products.
Ad: https://www.facebook.com/ads/library/?id=757455003018522 — page “RunnerHub Deals”

FOR THE TRADEMARK OWNER

Facebook — Trademark report form ↗for the trademark owner; has a dedicated option for content offering counterfeit goods

Instagram / Threads — Counterfeit report form ↗selling or promoting counterfeit goods on Instagram or Threads

Instagram — Trademark report form ↗use of the brand name or logo on Instagram without permission

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

Signal	Group	Points	Evidence
company number not in the registry shop_company_not_in_registry	Seller	+25	company number 88812345 (Company No.) does not exist in OpenCorporates (recorded)
half the official price or less shop_price_far_below_official	Offer	+20	50 USD per item (⁨ner — Clearance Buy 2 pairs for $99! Free shi⁩) — 33% of the official 150 USD (ShopNova Runner)
reviews say scam / replica shop_reviews_warn	Reputation	+15	a search result about the shop mentions “⁨scam⁩”: ⁨runnerhub-sale.com reviews⁩
Gmail-type contact only shop_free_email_only	Contact & policies	+12	the only contact e-mail is a free mailbox (support.runnerhub@outlook.com)
new domain shop_new_domain	Freshness	+12	domain registered 12 day(s) ago
no privacy / terms / returns shop_no_policy_pages	Contact & policies	+12	no privacy policy, terms or returns page linked from the shop's page
no footprint on Google shop_no_web_presence	Seller	+10	Google finds nothing about “88812345” outside the shop itself
multi-buy offer shop_multibuy_bait	Offer	+6	multi-buy offer: “⁨ner — Clearance Buy 2 pairs for $99! Free shi⁩”

How the score adds up

⚙ deterministic · versioned Raw 85 of 100 → normalised to 85 / 100. Thresholds: Medium 25 · High 50 · Critical 75 · scoring shop-v2-d92668ce
open the arithmetic ↗ — this site's section of the scan trace

Group caps ? · stop correlated evidence from double counting

Contact & policies

24 → 15

Offer

26 → 22

Freshness

12 → 8

Seller

35 → 25

Reputation

15 / 15

Confidence ? · 90%

Breadth (5 independent groups)	+70
Hard confirmers	+0
Evidence completeness	+20
Provider agreement	+0
Unavailable evidence	0
Single weak signal	0

Suspect vs. official similarity 62%

runnerhub-sale.com

the real ShopNova ?

VirusTotal · security vendors

0 of 90 engines flag this domain

malicious 0 · suspicious 0 · community reputation 0

Server reputation · AbuseIPDB

198.51.100.42 0/ 1000 report(s)

25 or more = several defenders reported abuse from this server.

JARM

d57a1623477bd45e6fb7198cfa5058142e5be5e40fbcb7b7339c471aa5aa96

Engines flagged first

Engine	Category	Result	Method
BitDefender	harmless	clean	blacklist
CRDF	harmless	clean	blacklist
ESET	harmless	clean	blacklist
Fortinet	harmless	clean	blacklist
Google Safebrowsing	harmless	clean	blacklist
Kaspersky	harmless	clean	blacklist
Netcraft	harmless	clean	blacklist
OpenPhish	harmless	clean	blacklist
Phishtank	harmless	clean	blacklist
Quttera	harmless	clean	blacklist
Sophos	harmless	clean	blacklist
Webroot	harmless	clean	blacklist

Look it up elsewhere

Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.

VirusTotal domain ↗VirusTotal relations ↗urlscan search ↗URLhaus ↗crt.sh ↗Google Safe Browsing ↗Wayback Machine ↗Censys ↗VirusTotal URL ↗VirusTotal IP ↗Shodan ↗AbuseIPDB ↗Censys host ↗

Jump to Registration WHOIS history DNS records Certificate

Registration data (RDAP)

Name: runnerhub-sale.com
registration: 2026-10-02
Status: —
DNSSEC: —

Registrar & abuse contact

Registrar: Mock Registrar LLC
Abuse email: —
registrant org: REDACTED FOR PRIVACY

Nameservers

—

Current WHOIS record (VirusTotal)

Domain Name: RUNNERHUB-SALE.COM Registrar: Mock Registrar LLC Registrar Abuse Contact Email: abuse@mock-registrar.example Creation Date: 2026-10-02T00:00:00Z Name Server: NS1.MOCK-DNS.EXAMPLE Registrant Country: US

WHOIS history · every WHOIS snapshot WhoisXML has recorded for runnerhub-sale.com

Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.

First registered

2026-10-02

Mock Registrar LLC

Snapshots

2026-10-03 → 2026-10-03

Owners seen

0 visible

0 owner change(s)

Registrars

0 transfer(s) · Mock Registrar LLC

Owner details now

Hidden

privacy since registration

TIMELINE

2026-10-02
Registered with privacy on
registrant shown as 'REDACTED FOR PRIVACY' · via Mock Registrar LLC · first WHOIS snapshot 2026-10-03

SNAPSHOTS · CHANGED FIELDS MARKED

Seen	Registrar	Registrant	Created · expires
2026-10-03	Mock Registrar LLC	hidden · REDACTED FOR PRIVACY	2026-10-02 · 2027-10-02
raw WHOIS · 2026-10-03 Domain Name: RUNNERHUB-SALE.COM Registrar: Mock Registrar LLC Creation Date: 2026-10-02T00:00:00Z Updated Date: 2026-10-03T00:00:00Z Registry Expiry Date: 2027-10-02T00:00:00Z Registrant Organization: REDACTED FOR PRIVACY Registrant Name: Registrant Email: Name Server: NS1.MOCK-DNS.EXAMPLE Name Server: NS2.MOCK-DNS.EXAMPLE

Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .

DNS records source: VirusTotal

A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).

Type	TTL	Value
A	300	198.51.100.42
AAAA	300	2001:db8::9ad4
NS	21600	ns1.mock-dns.example
NS	21600	ns2.mock-dns.example
MX	3600	mail.runnerhub-sale.com prio 10
SOA	1800	ns1.mock-dns.example rname hostmaster.runnerhub-sale.com · serial 2026100801

HTTPS certificate from VirusTotal

Common name: runnerhub-sale.com
Issuer: C=US O=Mock Trust Services CN=MT1
Valid: 2026-09-20 00:00:00 → 2026-12-19 00:00:00
32% of the validity period elapsed
Alt names (2): runnerhub-sale.com www.runnerhub-sale.com
SHA-256: 5b1e995f79993bf4d6a58defc544a92c90e3e506bb22162a92f7618378518e64 · crt.sh ↗

serial, signature, key, TLS and the full certificate

Subject: CN=runnerhub-sale.com
Serial: ed0badc8
Signature: sha256ECDSA
Public key: EC secp256r1
SHA-1: 8f44345d9650248041578a920fdf0e95c001a5ac

{ "cert_signature": { "signature_algorithm": "sha256ECDSA" }, "extensions": { "subject_alternative_name": [ "runnerhub-sale.com", "www.runnerhub-sale.com" ] }, "issuer": { "C": "US", "CN": "MT1", "O": "Mock Trust Services" }, "public_key": { "algorithm": "EC", "ec": { "oid": "secp256r1" } }, "serial_number": "ed0badc8", "subject": { "CN": "runnerhub-sale.com" }, "thumbprint": "8f44345d9650248041578a920fdf0e95c001a5ac", "thumbprint_sha256": "5b1e995f79993bf4d6a58defc544a92c90e3e506bb22162a92f7618378518e64", "validity": { "not_after": "2026-12-19 00:00:00", "not_before": "2026-09-20 00:00:00" }, "version": "V3" }

Jump to Servers urlscan & similar sites Passive DNS & relations

198.51.100.42

India · Mumbai · AS64609 · Mock Hosting LLC · 198.51.100.0/24 · RIPE NCC

0 of 94 engines flag this IP · 5 sites hosted, 2 flagged · 0 communicating files

VirusTotal IP ↗Shodan ↗AbuseIPDB ↗Censys host ↗ open server page →

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

0/ 100

No reports in the last 90 days

Data Center/Web Hosting/Transit · Mock Hosting LLC

A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

Last resolved	Detections	Domain
2026-10-13	5/ 95	runnerhub-sale.com	VT ↗ · urlscan ↗
2026-10-07	5/ 95	wallet-sync-0042.online	VT ↗ · urlscan ↗
2026-10-11	0/ 90	secure-login-0042.top	VT ↗ · urlscan ↗
2026-10-05	0/ 90	support-desk-0042.site	VT ↗ · urlscan ↗
2026-10-09	0/ 90	verify-account-0042.xyz	VT ↗ · urlscan ↗

COMMUNICATING FILES not fetched yet

IP WHOIS record

inetnum: 198.51.100.0 - 198.51.100.255 org-name: Mock Hosting LLC abuse-mailbox: abuse@mock.example

engine verdicts for this IP (12)

Engine	Category	Result
BitDefender	harmless	clean
CRDF	harmless	clean
ESET	harmless	clean
Fortinet	harmless	clean
Google Safebrowsing	harmless	clean
Kaspersky	harmless	clean
Netcraft	harmless	clean
OpenPhish	harmless	clean
Phishtank	harmless	clean
Quttera	harmless	clean
Sophos	harmless	clean
Webroot	harmless	clean

urlscan.io scan

not flagged by urlscan

Netherlands 203.0.113.66AS64512 BulletproofHost BV server nginx 23 requests · 2 domains · 1 IPs · 1 countries scanned 2026-10-14 09:50

title: runnerhub-sale.com - Sign in

full urlscan result ↗all scans of runnerhub-sale.com ↗

domains contacted by the page (2)

runnerhub-sale.com · cdn.mock-static.example

Similar sites 30

Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.

Same page (identical document hash) 4hash:95068126c9d90a8add7dc9b401801bb7d7bb5cac17cfcc868fbb4bc5078e5208

the same HTML served elsewhere — the same phishing kit

Seen	Verdict	Domain		Title
2026-09-16	—	shopn0va.com	urlscan ↗ · VT ↗	shopn0va.com - Sign in
2026-09-15	—	shopnova-login.com	urlscan ↗ · VT ↗	shopnova-login.com - Sign in
2026-09-14	—	secure-shopnova.com	urlscan ↗ · VT ↗	secure-shopnova.com - Sign in
2026-09-08	—	shopnova.co	urlscan ↗ · VT ↗	shopnova.co - Sign in

Same server 0page.ip:203.0.113.66

other pages scanned on the same IP

none

Same brand name 26page.domain:shopnova

domains containing the brand name

Seen	Verdict	Domain		Title
2026-10-14	—	shopnova-partners.com	urlscan ↗ · VT ↗	shopnova-partners.com - Sign in
2026-10-13	—	shopnova-blog.net	urlscan ↗ · VT ↗	shopnova-blog.net - Sign in
2026-10-12	—	shopnovafans.com	urlscan ↗ · VT ↗	shopnovafans.com - Sign in
2026-10-11	—	shopnova-reviews.com	urlscan ↗ · VT ↗	shopnova-reviews.com - Sign in
2026-10-10	—	shopnova-careers.com	urlscan ↗ · VT ↗	shopnova-careers.com - Sign in
2026-10-09	—	shopnova-deals.com	urlscan ↗ · VT ↗	shopnova-deals.com - Sign in
2026-10-08	—	shopnova-status.com	urlscan ↗ · VT ↗	shopnova-status.com - Sign in
2026-10-07	—	shopnova-community.org	urlscan ↗ · VT ↗	shopnova-community.org - Sign in
2026-10-06	—	shopnova-press.com	urlscan ↗ · VT ↗	shopnova-press.com - Sign in
2026-10-05	—	shopnova-events.com	urlscan ↗ · VT ↗	shopnova-events.com - Sign in
2026-09-24	—	shopnova.com	urlscan ↗ · VT ↗	shopnova.com - Sign in
2026-09-23	—	www.shopnova.com	urlscan ↗ · VT ↗	www.shopnova.com - Sign in
2026-09-22	—	shopnova.co.il	urlscan ↗ · VT ↗	shopnova.co.il - Sign in
2026-09-13	—	shopnova-verify.com	urlscan ↗ · VT ↗	shopnova-verify.com - Sign in
2026-09-10	—	shopnova-account.net	urlscan ↗ · VT ↗	shopnova-account.net - Sign in
2026-09-09	—	shopnova-support-center.com	urlscan ↗ · VT ↗	shopnova-support-center.com - Sign in
2026-09-06	—	shopnova-giftcard.com	urlscan ↗ · VT ↗	shopnova-giftcard.com - Sign in
2026-09-05	—	shopnova-refund.net	urlscan ↗ · VT ↗	shopnova-refund.net - Sign in
2026-09-04	—	shopnova-verification.com	urlscan ↗ · VT ↗	shopnova-verification.com - Sign in
2026-09-03	—	shopnova--sneakers.com	urlscan ↗ · VT ↗	shopnova--sneakers.com - Sign in
2026-09-02	—	shopnova-eu.com	urlscan ↗ · VT ↗	shopnova-eu.com - Sign in
2026-09-01	—	shopnova-id-check.com	urlscan ↗ · VT ↗	shopnova-id-check.com - Sign in
2026-08-20	—	shopnova-support.com	urlscan ↗ · VT ↗	shopnova-support.com - Sign in
2026-08-19	—	shopnova-review.com	urlscan ↗ · VT ↗	shopnova-review.com - Sign in
2026-08-18	—	shopnova-coupons.com	urlscan ↗ · VT ↗	shopnova-coupons.com - Sign in

Passive DNS replication 1

Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.

Date resolved	Detections (IP)	IP
2026-09-27	3/ 92	198.51.100.42

Subdomains 3

Host	Detections
login.runnerhub-sale.com	2/ 92
mail.runnerhub-sale.com	0/ 90
www.runnerhub-sale.com	0/ 90

Communicating files 0 not fetched yet

Malware samples that contacted this domain while being analysed.

Historical WHOIS · VirusTotal 1

2026-09-14 · Mock Registrar LLC

Registrant Organization: REDACTED FOR PRIVACY
Registrant Country: US
Name Server: NS1.MOCK-DNS.EXAMPLE

Historical certificates 0 VT · 1 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Not before	Names	Issuer
2026-09-30	runnerhub-sale.com, www.runnerhub-sale.com	C=US, O=Let's Encrypt, CN=R3

Observation timeline

2026-10-12 06:41:48 · HTTP 200 · state new · datacenter · content changed · 25d93580837d · screenshot
2026-10-12 06:46:01 · HTTP 200 · state flagged · datacenter · 25d93580837d · screenshot

first seen 2026-10-12 06:41 · scans 2 · next 2026-10-12 12:46 · candidate state flagged · WHOIS history →

Score history

When	Score	Severity	Confidence	Version
2026-10-12 06:41:48	85	critical	90%	shop-v2-d92668ce
2026-10-12 06:46:01 current	85	critical	90%	shop-v2-d92668ce

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.

Observed (UTC)	Type	Role	Source	SHA-256	Details
2026-10-12 06:46:01	reputation	contradicting	mock:safebrowsing	—	status: negative
2026-10-12 06:46:01	reputation	context	mock:urlhaus	—	status: unknown
2026-10-12 06:46:01	reputation	context	mock:virustotal	—	status: unknown
2026-10-12 06:46:01	whois	primary	mock:rdap	—	status: positive
2026-10-12 06:46:01	favicon	context	mock:playwright	3c94f04b8d481ada	mmh3: 1717389753 phash: cfcc3033cd3292cd	artifact
2026-10-12 06:46:01	screenshot · datacenter view	context	mock:playwright	6b034c9e37d13fff	phash: ce1f91d15cd4c343 dhash: c877652361850a65 palette: ['#fdf4f8', '#f0e9ec', '#fe…	artifact
2026-10-12 06:46:01	html · datacenter view	primary	mock:playwright	25d93580837d208e	title: RunnerHub — ShopNova Runner… forms: 0 parked: False	artifact
2026-10-12 06:46:01	http	supporting	mock:playwright	25d93580837d208e	status: 200 final_url: https://runnerhub-sale.com/ content_type: text/html; charset=utf-8
2026-10-12 06:46:01	dns	supporting	mock:local_dns	—	status: positive
2026-10-12 06:41:48	reputation	contradicting	mock:safebrowsing	—	status: negative
2026-10-12 06:41:48	reputation	context	mock:urlhaus	—	status: unknown
2026-10-12 06:41:48	reputation	context	mock:virustotal	—	status: unknown

show all 18 evidence rows from 2 scan(s)

2026-10-12 06:41:48	whois	primary	mock:rdap	—	status: positive
2026-10-12 06:41:48	favicon	context	mock:playwright	3c94f04b8d481ada	mmh3: 1717389753 phash: cfcc3033cd3292cd	artifact
2026-10-12 06:41:48	screenshot · datacenter view	context	mock:playwright	6b034c9e37d13fff	phash: ce1f91d15cd4c343 dhash: c877652361850a65 palette: ['#fdf4f8', '#f0e9ec', '#fe…	artifact
2026-10-12 06:41:48	html · datacenter view	primary	mock:playwright	25d93580837d208e	title: RunnerHub — ShopNova Runner… forms: 0 parked: False	artifact
2026-10-12 06:41:48	http	supporting	mock:playwright	25d93580837d208e	status: 200 final_url: https://runnerhub-sale.com/ content_type: text/html; charset=utf-8
2026-10-12 06:41:48	dns	supporting	mock:local_dns	—	status: positive

runnerhub-sale.com

What do I do · get it taken down

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

Conclusion · how sure are we that it sells fakes? — every letter and report claims only this

Shop checks · is this a real seller of ShopNova products? · separate from the phishing score (shop-v2-d92668ce)

AI: is this shop legitimate? · advisory, never part of the score

Where it was found

Report to Meta · the ads and the pages that send buyers to this shop

RunnerHub Deals 1 adalso on Instagram

FOR THE TRADEMARK OWNER

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

How the score adds up

Group caps ? · stop correlated evidence from double counting

Confidence ? · 90%

Suspect vs. official similarity 62%

VirusTotal · security vendors

Server reputation · AbuseIPDB

Categories

JARM

Engines flagged first

Look it up elsewhere

Registration data (RDAP)

Registrar & abuse contact

Nameservers

WHOIS history · every WHOIS snapshot WhoisXML has recorded for runnerhub-sale.com

First registered

Snapshots

Owners seen

Registrars

Owner details now

TIMELINE

SNAPSHOTS · CHANGED FIELDS MARKED

DNS records source: VirusTotal

HTTPS certificate from VirusTotal

198.51.100.42

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

COMMUNICATING FILES not fetched yet

urlscan.io scan

Similar sites 30

Same page (identical document hash) 4hash:95068126c9d90a8add7dc9b401801bb7d7bb5cac17cfcc868fbb4bc5078e5208

Same server 0page.ip:203.0.113.66

Same brand name 26page.domain:*shopnova*

Passive DNS replication 1

Subdomains 3

Communicating files 0 not fetched yet

Historical WHOIS · VirusTotal 1

Historical certificates 0 VT · 1 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Observation timeline

Score history

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Same brand name 26page.domain:shopnova