Takedown request BW-570AE512 · shopn0va.com
Two jobs on this page: send the request to the registrar, the hosting provider and the CDN, and report the site to 26 blocklists, security vendors and national services ↓ (0 done so far).
Where to send it · three channels — the fastest one is often not the registrar
Send the request to all three that apply. The hosting provider can switch the server off; a CDN / DNS provider (e.g. Cloudflare) can disable the proxy or the zone even when the origin host ignores you; the registrar can suspend the domain itself. Each button opens a pre-filled mail in your own mail client — BrandWatch never sends anything — then press ✓ sent to record it.
1 · Registrar
2 · Hosting provider
3 · CDN / DNS provider
No CDN detected — nameservers: ns1.mock-dns.example, ns2.mock-dns.example. If the DNS is hosted by a third party, add its abuse address:
Request · editable while in draft / review / reopened
Locked in state sent.
To: <abuse contact — resolve via WHOIS / abuse.net / hosting provider> Subject: Phishing site impersonating ShopNova — request for takedown: shopn0va.com Hello Mock Registrar LLC abuse team, We are reporting a website that impersonates ShopNova and appears designed to harvest user credentials. Impersonating URL : https://shopn0va.com/ Hostname : shopn0va.com First observed : 2026-10-12T06:41:46.604012 Risk assessment : CRITICAL (score 85 / 100, confidence 100 %) Evidence (full package with hashes and screenshots attached / available on request): - favicon_exact: favicon mmh3 -2029202433 equals the brand's favicon hash - screenshot_similarity_ge_90: homepage screenshot is 100% similar to the brand's (pHash) - cohosted_with_known_phish: shares server 203.0.113.66 with known phishing of this brand - tracking_id_shared: tracking id UA-424242-1 also present on known phishing pages - credential_form: page contains a password field - cert_shared_with_phish: TLS certificate fingerprint also used by known phishing - login_dom_similarity: login form markup is 100% identical to the brand's - vt_flagged: virustotal flags this host as malicious - domain age: domain registered 3 day(s) ago - screenshot similarity to the official site: 100 % - every observation is stored immutably with timestamp, collector version and SHA-256. We respectfully request that you suspend the domain / hosting for the content above and confirm when done. Please reference this case id in replies: 570ae512-6ffc-4714-8115-deadd322f8ee. Thank you, ShopNova brand protection
Case management ⚙ audited state machine · review = a four-eyes check before anything is sent; sent = recorded after mailing it yourself
draft → review → approved → sent → acknowledged → in_progress → resolved (+ rejected / reopened). BrandWatch never sends: an analyst sends the approved text from their own mailbox and then records sent here.
Timestamps
| Created | |
|---|---|
| Updated | |
| Sent | |
| Response | — |
| Resolved | — |
Attach the evidence package (HTML / JSON) generated from the finding.
Report the site everywhere · 3 of 26 done
Blocklists and anti-virus vendors flag the site for users world-wide within hours, long before a takedown lands. Every vendor that flags it also shows up on VirusTotal, which search engines and mail filters consult — so the site drops out of Google results too. Open each portal, report https://shopn0va.com/ , then tick it.