risk ?

critical fake social account awaiting verdict brand ShopNova

instagram.com/shopnova.israel.official

A Instagram account named “ShopNova Israel | Official”. It uses the ShopNova logo, presents itself as ShopNova's own account, sends people to onestyle-shopping.com, and asks for payments, card or order details. The AI read its content: Poses as the brand to collect payments or personal details.

found by Facebook pages / Instagram profiles confidence ?80% content · https://www.instagram.com/shopnova.israel.official/ hosted

203.0.113.66 registrar Mock Registrar LLC

An account on Instagram, not a website: there is no domain or server to look up — it is reported to Meta (see Social account).

What do I do · review the evidence below, then give a verdict

Several independent signs that this account poses as ShopNova → confirm, then report the account to Meta (Social account tab).

domain timeline

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

No notes yet.

◎ Instagram not verified

ShopNova Israel | Official

https://www.instagram.com/shopnova.israel.official/ ↗

Posts

Followers / likes

1,240

Checks · is this ShopNova? · a separate social score (social-v1-6ace7e14), never mixed with the phishing one

Claims to be the brand

presents itself as the brand's “official” account: ShopNova Israel | Official

Uses the brand's logo

its profile picture is the brand's logo (0 bits apart by perceptual hash)

Links off the brand

sends people to onestyle-shopping.com, which is not one of the brand's sites

Scam lures

asks for or offers: “giveaway”, “pay only shipping”, “only shipping”, “pay shipping”

AI: impersonation

the AI read the content: Poses as the brand to collect payments or personal details.

AI: does it pose as ShopNova? · reads the content · at most 20 of 100 points

IMPERSONATION

90% · mock:openai · claims to be the brand

Poses as the brand to collect payments or personal details.

asks for: shipping payment

calls itself the brand or its support
asks people to message it or pay outside the official site
links to a site that is not the brand's

What the account says · public content, as collected

Bio (Instagram @shopnova.israel.official)

Giveaway! 2 pairs of ShopNova Runner. Follow, tag 3 friends and pay only shipping (19 ILS) at the link

Links

https://onestyle-shopping.com/

Report to Meta · the account and the impersonation forms

Meta's own “Report ad” and “Report Page” flows work for anyone with a Facebook account. BrandWatch prepares the links and the text; a person files the report. Draft a takedown to keep track of what was reported.

@shopnova.israel.official

Open the profile ↗

Report the profile: open it → “…” → Report → Report account → It's pretending to be someone else → A business or organisation.

Text to paste into the report

This Instagram account “ShopNova Israel | Official” (https://www.instagram.com/shopnova.israel.official/) is pretending to be ShopNova. It is not an account of ShopNova.
A Instagram account named “ShopNova Israel | Official”. It uses the ShopNova logo, presents itself as ShopNova's own account, sends people to onestyle-shopping.com, and asks for payments, card or order details. The AI read its content: Poses as the brand to collect payments or personal details.
- presents itself as the brand's “official” account: ShopNova Israel | Official
- its profile picture is the brand's logo (0 bits apart by perceptual hash)
- sends people to onestyle-shopping.com, which is not one of the brand's sites
- asks for or offers: “giveaway”, “pay only shipping”, “only shipping”, “pay shipping”
- the AI read the content: Poses as the brand to collect payments or personal details.

FOR THE TRADEMARK OWNER

Facebook — Report an impostor account ↗a page or profile pretending to be the brand; works without a Facebook login

Instagram — Report impersonation ↗an Instagram or Threads account pretending to be the brand or someone you represent

Facebook — Trademark report form ↗for the trademark owner; has a dedicated option for content offering counterfeit goods

Instagram — Trademark report form ↗use of the brand name or logo on Instagram without permission

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

Signal	Group	Points	Evidence
AI: impersonation social_ai_impersonation	AI reading	+20	the AI read the content: Poses as the brand to collect payments or personal details.
claims to be the brand social_claims_official	Identity	+18	presents itself as the brand's “official” account: ShopNova Israel \| Official
uses the brand's logo social_logo_match	Visual	+18	its profile picture is the brand's logo (0 bits apart by perceptual hash)
links off the brand social_links_off_brand	Behaviour	+15	sends people to onestyle-shopping.com, which is not one of the brand's sites
scam lures social_scam_lures	Behaviour	+15	asks for or offers: “giveaway”, “pay only shipping”, “only shipping”, “pay shipping”

How the score adds up

⚙ deterministic · versioned Raw 86 of 100 → normalised to 86 / 100. Thresholds: Medium 25 · High 50 · Critical 75 · scoring social-v1-6ace7e14
open the arithmetic ↗ — this site's section of the scan trace

Group caps ? · stop correlated evidence from double counting

Identity

18 / 100

Visual

18 / 100

Behaviour

30 / 100

AI reading

20 / 100

Confidence ? · 80%

Breadth (4 independent groups)	+70
Hard confirmers	+0
Evidence completeness	+10
Provider agreement	+0
Unavailable evidence	0
Single weak signal	0

Suspect vs. official

instagram.com/shopnova.israel.official

No screenshot captured (unavailable — not "clean").

the real ShopNova ?

VirusTotal · security vendors

0 of 90 engines flag this domain

malicious 0 · suspicious 0 · community reputation 0

Server reputation · AbuseIPDB

203.0.113.66 87/ 100143 report(s)

25 or more = several defenders reported abuse from this server.

JARM

3c26a40d85a2f3dc024ae9233efaa58f748f853c96856ed65c0b5de20054bd

Engines flagged first

Engine	Category	Result	Method
BitDefender	harmless	clean	blacklist
CRDF	harmless	clean	blacklist
ESET	harmless	clean	blacklist
Fortinet	harmless	clean	blacklist
Google Safebrowsing	harmless	clean	blacklist
Kaspersky	harmless	clean	blacklist
Netcraft	harmless	clean	blacklist
OpenPhish	harmless	clean	blacklist
Phishtank	harmless	clean	blacklist
Quttera	harmless	clean	blacklist
Sophos	harmless	clean	blacklist
Webroot	harmless	clean	blacklist

Look it up elsewhere

Each link opens the external service's own page for this site — nothing is sent from here beyond the name in the URL.

VirusTotal domain ↗VirusTotal relations ↗urlscan search ↗URLhaus ↗crt.sh ↗Google Safe Browsing ↗Wayback Machine ↗Censys ↗VirusTotal URL ↗VirusTotal IP ↗Shodan ↗AbuseIPDB ↗Censys host ↗

Jump to Registration WHOIS history DNS records Certificate

Registration data (RDAP)

Name: instagram.com
registration: 2026-04-17
Status: —
DNSSEC: —

Registrar & abuse contact

Registrar: Mock Registrar LLC
Abuse email: —
registrant org: REDACTED FOR PRIVACY

Nameservers

—

Current WHOIS record (VirusTotal)

Domain Name: INSTAGRAM.COM/SHOPNOVA.ISRAEL.OFFICIAL Registrar: Mock Registrar LLC Registrar Abuse Contact Email: abuse@mock-registrar.example Creation Date: 2025-09-30T00:00:00Z Name Server: NS1.MOCK-DNS.EXAMPLE Registrant Country: US

WHOIS history · every WHOIS snapshot WhoisXML has recorded for instagram.com

Who registered the domain, when, through which registrar, and every change since: transfers, new owners, re-registration after expiry, privacy switched on or off. Phishers often register with their real details and hide them a day later — that first snapshot is a lead.

First registered

—

Snapshots

— → —

Owners seen

0 visible

0 owner change(s)

Registrars

0 transfer(s) · —

Owner details now

Visible

published in WHOIS

TIMELINE

SNAPSHOTS · CHANGED FIELDS MARKED

Seen	Registrar	Registrant	Created · expires

Source: WhoisXML WHOIS History API (whois-history.whoisxmlapi.com) · cached 24 h · fetched .

DNS records source: VirusTotal

A records are the servers hosting the site — click one to see everything else hosted there. NS tells you who runs its DNS (Cloudflare nameservers hide the real origin).

Type	TTL	Value
A	300	203.0.113.66
AAAA	300	2001:db8::8bac
NS	21600	ns1.mock-dns.example
NS	21600	ns2.mock-dns.example
MX	3600	mail.instagram.com/shopnova.israel.official prio 10
SOA	1800	ns1.mock-dns.example rname hostmaster.instagram.com/shopnova.israel.official · serial 2026100801

HTTPS certificate from VirusTotal

Common name: instagram.com/shopnova.israel.official
Issuer: C=US O=Mock Trust Services CN=MT1
Valid: 2026-09-20 00:00:00 → 2026-12-19 00:00:00
32% of the validity period elapsed
Alt names (2): instagram.com/shopnova.israel.official www.instagram.com/shopnova.israel.official
SHA-256: e17f2a9143adf0bce1e9028728330d00a1385343336a1a739da4426198c9919a · crt.sh ↗

serial, signature, key, TLS and the full certificate

Subject: CN=instagram.com/shopnova.israel.official
Serial: 37845428
Signature: sha256ECDSA
Public key: EC secp256r1
SHA-1: 7ba55e82c4b2c93a3121284c44e4301f56c8af38

{ "cert_signature": { "signature_algorithm": "sha256ECDSA" }, "extensions": { "subject_alternative_name": [ "instagram.com/shopnova.israel.official", "www.instagram.com/shopnova.israel.official" ] }, "issuer": { "C": "US", "CN": "MT1", "O": "Mock Trust Services" }, "public_key": { "algorithm": "EC", "ec": { "oid": "secp256r1" } }, "serial_number": "37845428", "subject": { "CN": "instagram.com/shopnova.israel.official" }, "thumbprint": "7ba55e82c4b2c93a3121284c44e4301f56c8af38", "thumbprint_sha256": "e17f2a9143adf0bce1e9028728330d00a1385343336a1a739da4426198c9919a", "validity": { "not_after": "2026-12-19 00:00:00", "not_before": "2026-09-20 00:00:00" }, "version": "V3" }

Jump to Servers urlscan & similar sites Passive DNS & relations

203.0.113.66

Netherlands · Amsterdam · AS64531 · BulletproofHost BV · 203.0.113.0/24 · RIPE NCC

3 of 94 engines flag this IP · 8 sites hosted, 3 flagged · 4 communicating files

VirusTotal IP ↗Shodan ↗AbuseIPDB ↗Censys host ↗ open server page →

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

87/ 100

143 report(s) from 38 reporter(s) · last 2026-10-14 01:49

Data Center/Web Hosting/Transit · BulletproofHost BV

A score of 25 or more means several independent reporters saw abuse from this IP: phishing, scanning, spam or brute force. A fresh kit on a clean IP scores 0 — unknown, not clean.

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

Last resolved	Detections	Domain
2026-10-13	5/ 95	shopn0va.com	VT ↗ · urlscan ↗
2026-10-07	5/ 95	shopnova.co	VT ↗ · urlscan ↗
2026-10-01	5/ 95	wallet-sync-1366.online	VT ↗ · urlscan ↗
2026-10-05	0/ 90	secure-login-1366.top	VT ↗ · urlscan ↗
2026-10-09	0/ 90	secure-shopnova.com	VT ↗ · urlscan ↗
2026-10-11	0/ 90	shopnova-login.com	VT ↗ · urlscan ↗
2026-09-29	0/ 90	support-desk-1366.site	VT ↗ · urlscan ↗
2026-10-03	0/ 90	verify-account-1366.xyz	VT ↗ · urlscan ↗

COMMUNICATING FILES

Scanned	Detections	Type	Name
2026-10-09	6/ 66	Android	Draky and the Twilight Castle.apk
2026-09-21	5/ 66	Android	Orbit - Igra s gravitaciey.apk
2026-09-12	4/ 66	PDF	invoice_4411.pdf
2026-09-30	0/ 66	PDF	REMITTANCE 2-For-Cokecanada.pdf

HISTORICAL WHOIS (IP block)

2026-09-12 · Mock Registrar LLC

IP WHOIS record

inetnum: 203.0.113.0 - 203.0.113.255 org-name: BulletproofHost BV abuse-mailbox: abuse@bulletproofhost.example

engine verdicts for this IP (12)

Engine	Category	Result
BitDefender	malicious	phishing
ESET	malicious	phishing
Fortinet	malicious	phishing
Google Safebrowsing	malicious	phishing
Kaspersky	malicious	phishing
OpenPhish	malicious	phishing
Phishtank	malicious	phishing
Sophos	malicious	phishing
CRDF	harmless	clean
Netcraft	harmless	clean
Quttera	harmless	clean
Webroot	harmless	clean

urlscan.io scan

not flagged by urlscan

Netherlands 203.0.113.66AS64512 BulletproofHost BV server nginx 23 requests · 2 domains · 1 IPs · 1 countries scanned 2026-10-14 09:50

title: www.instagram.com - Sign in

full urlscan result ↗all scans of instagram.com/shopnova.israel.official ↗

domains contacted by the page (2)

www.instagram.com · cdn.mock-static.example

Similar sites 4

Other pages urlscan has seen that share this site's page hash (same kit), its server, or the brand name.

Same page (identical document hash) 4hash:520213ec06442ab5822d2fdc888520345cd66aa3729d008992e0b2f2df67dbc9

the same HTML served elsewhere — the same phishing kit

Seen	Verdict	Domain		Title
2026-09-16	—	shopn0va.com	urlscan ↗ · VT ↗	shopn0va.com - Sign in
2026-09-15	—	shopnova-login.com	urlscan ↗ · VT ↗	shopnova-login.com - Sign in
2026-09-14	—	secure-shopnova.com	urlscan ↗ · VT ↗	secure-shopnova.com - Sign in
2026-09-08	—	shopnova.co	urlscan ↗ · VT ↗	shopnova.co - Sign in

Same server 0page.ip:203.0.113.66

other pages scanned on the same IP

none

Same brand name 0page.domain:shopnovaisrael

domains containing the brand name

none

Passive DNS replication 1

Every IP this domain has resolved to, with how many engines flag that IP. Click an IP to see the other sites on it.

Date resolved	Detections (IP)	IP
2026-09-27	3/ 92	203.0.113.66

Subdomains 3

Host	Detections
login.instagram.com/shopnova.israel.official	2/ 92
mail.instagram.com/shopnova.israel.official	0/ 90
www.instagram.com/shopnova.israel.official	0/ 90

Communicating files 0 not fetched yet

Malware samples that contacted this domain while being analysed.

Historical WHOIS · VirusTotal 1

2026-09-14 · Mock Registrar LLC

Registrant Organization: REDACTED FOR PRIVACY
Registrant Country: US
Name Server: NS1.MOCK-DNS.EXAMPLE

Historical certificates 0 VT · 2 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Not before	Names	Issuer
2026-09-01	mail0.instagram.com-cdn.net	Mock CA
2026-09-01	mail1.instagram.com-cdn.net	Mock CA

Observation timeline

2026-10-12 06:41:46 · HTTP — · state new · datacenter · fabebd52b998
2026-10-12 06:46:00 · HTTP — · state flagged · datacenter · fabebd52b998
2026-10-18 06:29:19 · HTTP — · state flagged · datacenter · content changed · 6176c21f3e06

first seen 2026-10-12 06:41 · scans 3 · next — · candidate state flagged · WHOIS history →

Score history

When	Score	Severity	Confidence	Version
2026-10-12 06:41:46	86	critical	80%	social-v1-6ace7e14
2026-10-12 06:46:00	86	critical	80%	social-v1-6ace7e14
2026-10-18 06:29:19 current	86	critical	80%	social-v1-6ace7e14

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Append-only by the database: UPDATE and DELETE are rejected by triggers, even for an admin. Every artifact is stored under its own SHA-256, so the hash is literally the file name — any tampering is visible. Role: primary = proves a signal · supporting = corroborates · contradicting = argues the site is legitimate · context = background.

Observed (UTC)	Type	Role	Source	SHA-256	Details
2026-10-18 06:29:19	favicon	context	instagram:profile_picture	ffd6e7f7b2b08577	phash: dc966349c3693c96 profile_picture: True	artifact
2026-10-18 06:29:19	http	supporting	searchapi:social	6176c21f3e06c773	status: positive platform: instagram name: ShopNova Israel \| Official +1	artifact
2026-10-12 06:46:00	favicon	context	instagram:profile_picture	ffd6e7f7b2b08577	phash: dc966349c3693c96 profile_picture: True	artifact
2026-10-12 06:46:00	http	supporting	searchapi:social	fabebd52b998f71c	status: positive platform: instagram name: ShopNova Israel \| Official +1	artifact
2026-10-12 06:41:46	favicon	context	instagram:profile_picture	ffd6e7f7b2b08577	phash: dc966349c3693c96 profile_picture: True	artifact
2026-10-12 06:41:46	http	supporting	searchapi:social	fabebd52b998f71c	status: positive platform: instagram name: ShopNova Israel \| Official +1	artifact

instagram.com/shopnova.israel.official

What do I do · review the evidence below, then give a verdict

Notes · for you and the next analyst — kept with the finding, never edited, also in Activity

Checks · is this ShopNova? · a separate social score (social-v1-6ace7e14), never mixed with the phishing one

AI: does it pose as ShopNova? · reads the content · at most 20 of 100 points

What the account says · public content, as collected

Report to Meta · the account and the impersonation forms

@shopnova.israel.official

FOR THE TRADEMARK OWNER

Explain Finding — why it was flagged · every signal, its points and the evidence behind it

How the score adds up

Group caps ? · stop correlated evidence from double counting

Confidence ? · 80%

Suspect vs. official

VirusTotal · security vendors

Server reputation · AbuseIPDB

Categories

JARM

Engines flagged first

Look it up elsewhere

Registration data (RDAP)

Registrar & abuse contact

Nameservers

WHOIS history · every WHOIS snapshot WhoisXML has recorded for instagram.com

First registered

Snapshots

Owners seen

Registrars

Owner details now

TIMELINE

SNAPSHOTS · CHANGED FIELDS MARKED

DNS records source: VirusTotal

HTTPS certificate from VirusTotal

203.0.113.66

Abuse reports · AbuseIPDB — what other defenders reported about this server in the last 90 days

SITES HOSTED ON THIS SERVER (passive DNS, each with its own detections)

COMMUNICATING FILES

HISTORICAL WHOIS (IP block)

urlscan.io scan

Similar sites 4

Same page (identical document hash) 4hash:520213ec06442ab5822d2fdc888520345cd66aa3729d008992e0b2f2df67dbc9

Same server 0page.ip:203.0.113.66

Same brand name 0page.domain:*shopnovaisrael*

Passive DNS replication 1

Subdomains 3

Communicating files 0 not fetched yet

Historical WHOIS · VirusTotal 1

Historical certificates 0 VT · 2 CT not fetched yet

CERTIFICATE TRANSPARENCY (crt.sh / CertSpotter) — the registrable domain and its subdomains

Observation timeline

Score history

Evidence · chain of custody ? ⚙ immutable · DB-enforced

Same brand name 0page.domain:shopnovaisrael