50
risk ?
shopnova--sneakers.com
Puts the ShopNova name in its address and asks for card details. Cloudflare, which serves the site, already blocks it with its own “Suspected Phishing” warning, and VirusTotal engines flag it.
found by Certificate logs
confidence ?100%
domain name · https://shopnova--sneakers.com/
hosted 
198.51.100.60
registrar Mock Registrar LLC
198.51.100.60
registrar Mock Registrar LLC
THREAT INTEL · what public blocklists say about this site — each card opens the lookup
What do I do · get it taken down
✓ Confirmed phishing ·
Attack infrastructure:
mapped → open the map
Notes · for you and the next analyst — kept with the finding, never edited, also in Activity
No notes yet.
Shop checks · is this a real seller of ShopNova products? · separate from the phishing score (shop-v2-d92668ce)
✓
About ShopNova
the page names “shopnova”
–
Company number
no company number on the page — not checked is never “valid”
✕
No privacy, terms or returns page
a real shop links them from every page
✕
Free-mail contact only
shopnova.outlet.help@gmail.com
✕
No company details
no company name or registration number on the page
–
Price vs official
no price in ILS found on the page
✓
Old domain
the domain is 3 years old
✕
No footprint on Google
Google finds nothing about “shopnova--sneakers.com” outside the shop itself
AI: is this shop legitimate? · advisory, never part of the score
LIKELY SCAM
90% · mock:openai · likely sells replicas
- no privacy policy, terms or returns page linked from the shop's page
- the only contact e-mail is a free mailbox (shopnova.outlet.help@gmail.com)
- no company name or registration number anywhere on the page
- Google finds nothing about “shopnova--sneakers.com” outside the shop itself
reviews mention fake or replica products
Where it was found
Country IL · page language en
Explain Finding — why it was flagged · every signal, its points and the evidence behind it
| Signal | Group | Points | Evidence |
|---|---|---|---|
| Cloudflare blocks it as phishing cloudflare_phishing_warning | Reputation | +15 | Cloudflare, which serves this site, shows its own “Suspected Phishing” warning instead of the site |
| brand name in the domain brand_exact_in_domain | Identity | +12 | brand 'shopnova' appears inside the domain label 'shopnova--sneakers' |
| asks for card details payment_form | Behaviour | +12 | page asks for card number / CVV / expiry |
| flagged on VirusTotal vt_flagged | Reputation | +12 | virustotal flags this host as malicious |
| page title claims the brand title_claims_brand | Behaviour | +10 | the page calls itself the brand: <title>ShopNova Official Store — Up to 70% Off</title> |
| brand + extra word combosquat | Identity | +8 | 'shopnova--sneakers' combines the brand with extra words |
| brand words in the text brand_keywords_in_content | Behaviour | +6 | brand terms in content: shop, shopnova |
How the score adds up
⚙ deterministic · versioned Raw 63 of 150 → normalised to 50 / 100 · severity raised to high by the rule “the brand's name in the address, and Cloudflare already blocks it as phishing”.
Thresholds: Medium 25 · High 50 · Critical 75 · scoring v2-c213b21d
open the arithmetic ↗ — this site's section of the scan trace
Group caps ? · stop correlated evidence from double counting
Identity
20 / 20
Visual
0 / 30
Behaviour
28 / 30
Infrastructure
0 / 20
Reputation
27 → 15
Freshness
0 / 10
Evasion
0 / 25
Confidence ? · 100%
| Breadth (3 independent groups) | +50 |
| Hard confirmers vt_flagged, cloudflare_phishing_warning | +30 |
| Evidence completeness | +15 |
| Provider agreement | +5 |
| Unavailable evidence | 0 |
| Single weak signal | 0 |
Suspect vs. official similarity 47%
shopnova--sneakers.com
the real ShopNova ?
Cloaking multi-probe ? ⚙ Tier 3/4 multi-probe
| Probe | Profile | Login form | Diverged | Note |
|---|---|---|---|---|
| bot | bot | yes | same | |
| param | datacenter | yes | same | |
| referer | referer | yes | same | |
| residential | residential | yes | same |
Fetched several ways — a crawler user-agent, a victim-style link (?email=), a Google referer, a phone (when chosen in Settings → Proxy) and a real home or phone-network IP (Tier 4). Residential (Tier 4): used. Residential IPs are used to look, never to interact.
8
VirusTotal · security vendors
8 of 90 engines flag this domain
malicious 7 · suspicious 1 · community reputation -5
Server reputation · AbuseIPDB
25 or more = several defenders reported abuse from this server.
Categories
phishing Mock Category Service
JARM
cedaef110871b24dd2533f16b7a73eb985f90ee0d6a8e2152b61b6ec12ac4d
Engines flagged first
| Engine | Category | Result | Method |
|---|---|---|---|
| BitDefender | malicious | phishing | blacklist |
| ESET | malicious | phishing | blacklist |
| Fortinet | malicious | phishing | blacklist |
| Google Safebrowsing | malicious | phishing | blacklist |
| Kaspersky | malicious | phishing | blacklist |
| OpenPhish | malicious | phishing | blacklist |
| Phishtank | malicious | phishing | blacklist |
| Sophos | malicious | phishing | blacklist |
| CRDF | harmless | clean | blacklist |
| Netcraft | harmless | clean | blacklist |
| Quttera | harmless | clean | blacklist |
| Webroot | harmless | clean | blacklist |
Look it up elsewhere
Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.
Registration data (RDAP)
- Name
- shopnova--sneakers.com
- registration
- 2023-08-26
- Status
- —
- DNSSEC
- —
Registrar & abuse contact
- Registrar
- Mock Registrar LLC
- Abuse email
- —
- registrant org
- REDACTED FOR PRIVACY
Nameservers
—Current WHOIS record (VirusTotal)
Domain Name: SHOPNOVA--SNEAKERS.COM
Registrar: Mock Registrar LLC
Registrar Abuse Contact Email: abuse@mock-registrar.example
Creation Date: 2023-08-26T00:00:00Z
Name Server: NS1.MOCK-DNS.EXAMPLE
Registrant Country: US
WHOIS history · every WHOIS snapshot WhoisXML has recorded for shopnova--sneakers.com
Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.
First registered
2023-08-26
Mock Registrar LLC
Snapshots
1
2023-08-27 → 2023-08-27
Owners seen
0 visible
0 owner change(s)
Registrars
1
0 transfer(s) · Mock Registrar LLC
Owner details now
Hidden
privacy since registration
TIMELINE
- 2023-08-26Registered with privacy onregistrant shown as 'REDACTED FOR PRIVACY' · via Mock Registrar LLC · first WHOIS snapshot 2023-08-27
SNAPSHOTS · CHANGED FIELDS MARKED
| Seen | Registrar | Registrant | Created · expires |
|---|---|---|---|
| 2023-08-27 | Mock Registrar LLC | hidden · REDACTED FOR PRIVACY | 2023-08-26 · 2027-08-25 |
raw WHOIS · 2023-08-27Domain Name: SHOPNOVA--SNEAKERS.COM
Registrar: Mock Registrar LLC
Creation Date: 2023-08-26T00:00:00Z
Updated Date: 2023-08-27T00:00:00Z
Registry Expiry Date: 2027-08-25T00:00:00Z
Registrant Organization: REDACTED FOR PRIVACY
Registrant Name:
Registrant Email:
Name Server: NS1.MOCK-DNS.EXAMPLE
Name Server: NS2.MOCK-DNS.EXAMPLE | |||
Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .
DNS records source: VirusTotal
A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).
| Type | TTL | Value |
|---|---|---|
| A | 300 | 198.51.100.60 |
| AAAA | 300 | 2001:db8::c29 |
| NS | 21600 | ns1.mock-dns.example |
| NS | 21600 | ns2.mock-dns.example |
| MX | 3600 | mail.shopnova--sneakers.com prio 10 |
| SOA | 1800 | ns1.mock-dns.example rname hostmaster.shopnova--sneakers.com · serial 2026100801 |
HTTPS certificate from VirusTotal
- Common name
- shopnova--sneakers.com
- Issuer
- C=US O=Mock Trust Services CN=MT1
- Valid
- 2026-09-20 00:00:00 → 2026-12-19 00:00:0032% of the validity period elapsed
- Alt names (2)
- shopnova--sneakers.com www.shopnova--sneakers.com
- SHA-256
- ded87ef4645a3153450fcd67640e227ec393c7bcc615846a0ec7992fd970b079 · crt.sh ↗
serial, signature, key, TLS and the full certificate
- Subject
- CN=shopnova--sneakers.com
- Serial
- 2fdddc4b
- Signature
- sha256ECDSA
- Public key
- EC secp256r1
- SHA-1
- ffd0b285933740d8c5f147e23c26a1544d8ca3d8
{
"cert_signature": {
"signature_algorithm": "sha256ECDSA"
},
"extensions": {
"subject_alternative_name": [
"shopnova--sneakers.com",
"www.shopnova--sneakers.com"
]
},
"issuer": {
"C": "US",
"CN": "MT1",
"O": "Mock Trust Services"
},
"public_key": {
"algorithm": "EC",
"ec": {
"oid": "secp256r1"
}
},
"serial_number": "2fdddc4b",
"subject": {
"CN": "shopnova--sneakers.com"
},
"thumbprint": "ffd0b285933740d8c5f147e23c26a1544d8ca3d8",
"thumbprint_sha256": "ded87ef4645a3153450fcd67640e227ec393c7bcc615846a0ec7992fd970b079",
"validity": {
"not_after": "2026-12-19 00:00:00",
"not_before": "2026-09-20 00:00:00"
},
"version": "V3"
}
0
198.51.100.60
Germany · Frankfurt · AS64558 · Mock Hosting LLC · 198.51.100.0/24 · RIPE NCC
0 of 94 engines flag this IP
· 5 sites hosted, 2 flagged · 0 communicating files
Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days
51/ 100
54 report(s) from 4 reporter(s) · last 2026-10-14 01:50
Data Center/Web Hosting/Transit · Mock Hosting LLC
A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.
SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)
| Last resolved | Detections | Domain | |
|---|---|---|---|
| 2026-10-13 | 5/ 95 | shopnova--sneakers.com | VT ↗ · urlscan ↗ |
| 2026-10-07 | 5/ 95 | wallet-sync-0060.online | VT ↗ · urlscan ↗ |
| 2026-10-11 | 0/ 90 | secure-login-0060.top | VT ↗ · urlscan ↗ |
| 2026-10-05 | 0/ 90 | support-desk-0060.site | VT ↗ · urlscan ↗ |
| 2026-10-09 | 0/ 90 | verify-account-0060.xyz | VT ↗ · urlscan ↗ |
COMMUNICATING FILES not fetched yet
IP WHOIS record
inetnum: 198.51.100.0 - 198.51.100.255
org-name: Mock Hosting LLC
abuse-mailbox: abuse@mock.example
engine verdicts for this IP (12)
| Engine | Category | Result |
|---|---|---|
| BitDefender | harmless | clean |
| CRDF | harmless | clean |
| ESET | harmless | clean |
| Fortinet | harmless | clean |
| Google Safebrowsing | harmless | clean |
| Kaspersky | harmless | clean |
| Netcraft | harmless | clean |
| OpenPhish | harmless | clean |
| Phishtank | harmless | clean |
| Quttera | harmless | clean |
| Sophos | harmless | clean |
| Webroot | harmless | clean |
urlscan.io scan
not flagged by urlscan
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-14 09:50
Netherlands
203.0.113.66AS64512 BulletproofHost BV
server nginx
23 requests · 2 domains · 1 IPs · 1 countries
scanned 2026-10-14 09:50
title: shopnova--sneakers.com - Sign in
domains contacted by the page (2)
shopnova--sneakers.com · cdn.mock-static.example
Similar sites 29
Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.
Same page (identical document hash) 4hash:cb713c399e848dfbd80e8e13053b13fddf72928b96dfc6ec9c005979c3279a18
the same HTML served elsewhere — the same phishing kit
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-09-16 | — | shopn0va.com |
urlscan ↗ · VT ↗ | shopn0va.com - Sign in |
| 2026-09-15 | — | shopnova-login.com |
urlscan ↗ · VT ↗ | shopnova-login.com - Sign in |
| 2026-09-14 | — | secure-shopnova.com |
urlscan ↗ · VT ↗ | secure-shopnova.com - Sign in |
| 2026-09-08 | — | shopnova.co |
urlscan ↗ · VT ↗ | shopnova.co - Sign in |
Same server 0page.ip:203.0.113.66
other pages scanned on the same IP
noneSame brand name 25page.domain:*shopnova*
domains containing the brand name
| Seen | Verdict | Domain | Title | |
|---|---|---|---|---|
| 2026-10-14 | — | shopnova-partners.com |
urlscan ↗ · VT ↗ | shopnova-partners.com - Sign in |
| 2026-10-13 | — | shopnova-blog.net |
urlscan ↗ · VT ↗ | shopnova-blog.net - Sign in |
| 2026-10-12 | — | shopnovafans.com |
urlscan ↗ · VT ↗ | shopnovafans.com - Sign in |
| 2026-10-11 | — | shopnova-reviews.com |
urlscan ↗ · VT ↗ | shopnova-reviews.com - Sign in |
| 2026-10-10 | — | shopnova-careers.com |
urlscan ↗ · VT ↗ | shopnova-careers.com - Sign in |
| 2026-10-09 | — | shopnova-deals.com |
urlscan ↗ · VT ↗ | shopnova-deals.com - Sign in |
| 2026-10-08 | — | shopnova-status.com |
urlscan ↗ · VT ↗ | shopnova-status.com - Sign in |
| 2026-10-07 | — | shopnova-community.org |
urlscan ↗ · VT ↗ | shopnova-community.org - Sign in |
| 2026-10-06 | — | shopnova-press.com |
urlscan ↗ · VT ↗ | shopnova-press.com - Sign in |
| 2026-10-05 | — | shopnova-events.com |
urlscan ↗ · VT ↗ | shopnova-events.com - Sign in |
| 2026-09-24 | — | shopnova.com |
urlscan ↗ · VT ↗ | shopnova.com - Sign in |
| 2026-09-23 | — | www.shopnova.com |
urlscan ↗ · VT ↗ | www.shopnova.com - Sign in |
| 2026-09-22 | — | shopnova.co.il |
urlscan ↗ · VT ↗ | shopnova.co.il - Sign in |
| 2026-09-13 | — | shopnova-verify.com |
urlscan ↗ · VT ↗ | shopnova-verify.com - Sign in |
| 2026-09-10 | — | shopnova-account.net |
urlscan ↗ · VT ↗ | shopnova-account.net - Sign in |
| 2026-09-09 | — | shopnova-support-center.com |
urlscan ↗ · VT ↗ | shopnova-support-center.com - Sign in |
| 2026-09-06 | — | shopnova-giftcard.com |
urlscan ↗ · VT ↗ | shopnova-giftcard.com - Sign in |
| 2026-09-05 | — | shopnova-refund.net |
urlscan ↗ · VT ↗ | shopnova-refund.net - Sign in |
| 2026-09-04 | — | shopnova-verification.com |
urlscan ↗ · VT ↗ | shopnova-verification.com - Sign in |
| 2026-09-02 | — | shopnova-eu.com |
urlscan ↗ · VT ↗ | shopnova-eu.com - Sign in |
| 2026-09-01 | — | shopnova-id-check.com |
urlscan ↗ · VT ↗ | shopnova-id-check.com - Sign in |
| 2026-08-20 | — | shopnova-support.com |
urlscan ↗ · VT ↗ | shopnova-support.com - Sign in |
| 2026-08-19 | — | shopnova-review.com |
urlscan ↗ · VT ↗ | shopnova-review.com - Sign in |
| 2026-08-18 | — | shopnova-coupons.com |
urlscan ↗ · VT ↗ | shopnova-coupons.com - Sign in |
| 2026-08-17 | — | shopnova-login-help.com |
urlscan ↗ · VT ↗ | shopnova-login-help.com - Sign in |
Passive DNS replication 1
Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.
| Date resolved | Detections (IP) | IP |
|---|---|---|
| 2026-09-27 | 3/ 92 | 198.51.100.60 |
Subdomains 3
| Host | Detections |
|---|---|
| login.shopnova--sneakers.com | 2/ 92 |
| mail.shopnova--sneakers.com | 0/ 90 |
| www.shopnova--sneakers.com | 0/ 90 |
Communicating files 0 not fetched yet
Malware samples that contacted this domain while being analysed.
Historical WHOIS · VirusTotal 1
2026-09-14 · Mock Registrar LLC
- Registrant Organization
- REDACTED FOR PRIVACY
- Registrant Country
- US
- Name Server
- NS1.MOCK-DNS.EXAMPLE
Historical certificates 0 VT · 3 CT not fetched yet
CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains
| Not before | Names | Issuer |
|---|---|---|
| 2026-09-30 | shopnova--sneakers.com, www.shopnova--sneakers.com | C=US, O=Let's Encrypt, CN=R3 |
| 2026-09-01 | mail0.shopnova--sneakers.com-cdn.net | Mock CA |
| 2026-09-01 | mail1.shopnova--sneakers.com-cdn.net | Mock CA |
Observation timeline
- 2026-10-12 06:41:51 · HTTP 403 · state new · datacenter · content changed · b5c8ed31224c · screenshot
- 2026-10-12 06:46:04 · HTTP 403 · state flagged · datacenter · b5c8ed31224c · screenshot
first seen 2026-10-12 06:41 · scans 2 · next 2026-10-12 12:46 · candidate state flagged · WHOIS history →
Score history
| When | Score | Severity | Confidence | Version |
|---|---|---|---|---|
| 2026-10-12 06:41:52 | 50 | high | 100% | v2-c213b21d |
| 2026-10-12 06:46:04 current | 50 | high | 100% | v2-c213b21d |
Evidence · chain of custody ? ⚙ immutable · DB-enforced
Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.
| Observed (UTC) | Type | Role | Source | SHA-256 | Details | |
|---|---|---|---|---|---|---|
| 2026-10-12 06:46:04 | http · residential view | supporting | mock:playwright | b5c8ed31224c9f86 | probe: residential status: 403 content_sha256: b5c8ed31224c9f864812c9e054d… +3 | |
| 2026-10-12 06:46:04 | http · referer view | supporting | mock:playwright | b5c8ed31224c9f86 | probe: referer status: 403 content_sha256: b5c8ed31224c9f864812c9e054d… +3 | |
| 2026-10-12 06:46:04 | http · param view | supporting | mock:playwright | b5c8ed31224c9f86 | probe: param status: 403 content_sha256: b5c8ed31224c9f864812c9e054d… +3 | |
| 2026-10-12 06:46:04 | http · bot view | supporting | mock:playwright | b5c8ed31224c9f86 | probe: bot status: 403 content_sha256: b5c8ed31224c9f864812c9e054d… +3 | |
| 2026-10-12 06:46:04 | reputation | primary | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:46:04 | reputation | primary | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:46:04 | reputation | primary | mock:virustotal | — | status: positive | |
| 2026-10-12 06:46:04 | whois | context | mock:rdap | — | status: positive | |
| 2026-10-12 06:46:04 | favicon | context | mock:playwright | 71cceedc67cfc808 | mmh3: 1393075904 phash: ea87b5529c32a5c9 | artifact |
| 2026-10-12 06:46:04 | screenshot · datacenter view | context | mock:playwright | 2555cfe82f159d65 | phash: e93a240314576f7e dhash: 9b93233131d38286 palette: ['#3a3c69', '#92b372', '#a6… | artifact |
| 2026-10-12 06:46:04 | html · datacenter view | primary | mock:playwright | b5c8ed31224c9f86 | title: ShopNova Official Store — U… forms: 1 parked: False | artifact |
| 2026-10-12 06:46:04 | http | supporting | mock:playwright | b5c8ed31224c9f86 | status: 403 final_url: https://shopnova--sneakers.com/ content_type: text/html; charset=UTF-8 |
show all 26 evidence rows from 2 scan(s)
| 2026-10-12 06:46:04 | dns | supporting | mock:local_dns | — | status: positive | |
| 2026-10-12 06:41:51 | http · residential view | supporting | mock:playwright | b5c8ed31224c9f86 | probe: residential status: 403 content_sha256: b5c8ed31224c9f864812c9e054d… +3 | |
| 2026-10-12 06:41:51 | http · referer view | supporting | mock:playwright | b5c8ed31224c9f86 | probe: referer status: 403 content_sha256: b5c8ed31224c9f864812c9e054d… +3 | |
| 2026-10-12 06:41:51 | http · param view | supporting | mock:playwright | b5c8ed31224c9f86 | probe: param status: 403 content_sha256: b5c8ed31224c9f864812c9e054d… +3 | |
| 2026-10-12 06:41:51 | http · bot view | supporting | mock:playwright | b5c8ed31224c9f86 | probe: bot status: 403 content_sha256: b5c8ed31224c9f864812c9e054d… +3 | |
| 2026-10-12 06:41:51 | reputation | primary | mock:safebrowsing | — | status: negative | |
| 2026-10-12 06:41:51 | reputation | primary | mock:urlhaus | — | status: unknown | |
| 2026-10-12 06:41:51 | reputation | primary | mock:virustotal | — | status: positive | |
| 2026-10-12 06:41:51 | whois | context | mock:rdap | — | status: positive | |
| 2026-10-12 06:41:51 | favicon | context | mock:playwright | 71cceedc67cfc808 | mmh3: 1393075904 phash: ea87b5529c32a5c9 | artifact |
| 2026-10-12 06:41:51 | screenshot · datacenter view | context | mock:playwright | 2555cfe82f159d65 | phash: e93a240314576f7e dhash: 9b93233131d38286 palette: ['#3a3c69', '#92b372', '#a6… | artifact |
| 2026-10-12 06:41:51 | html · datacenter view | primary | mock:playwright | b5c8ed31224c9f86 | title: ShopNova Official Store — U… forms: 1 parked: False | artifact |
| 2026-10-12 06:41:51 | http | supporting | mock:playwright | b5c8ed31224c9f86 | status: 403 final_url: https://shopnova--sneakers.com/ content_type: text/html; charset=UTF-8 | |
| 2026-10-12 06:41:51 | dns | supporting | mock:local_dns | — | status: positive |
Advisory opinions · shown for context, never part of the score ⚙ AI advisory · JSON schema
AI · mock:openai phishing impersonating ShopNova Official Store · 65% — card form; page presents itself as ShopNova Official Store
classifier · ml-5edcdd68-19 P(phishing) = 37% (cross-validated accuracy 94%)