Octopus Shield OCTOPUSSHIELD
EN
EnglishENTürkçeTRDeutschDEFrançaisFREspañolESالعربيةAR
Request a Demo

Sample report

What you receive when we find one.

This is a complete finding report, filled with synthetic data. Nothing here is a real customer or a real detection — it shows the shape and the depth of what lands in your inbox.

DEMO / SYNTHETIC

Invented domain, invented figures. Not a customer, not a live finding. Addresses shown are from the RFC 5737 documentation ranges — they point at no real server.

OS-F-2026-08-19-0417

northbay-login.top

91 Score
Brand
Northbay
First seen (UTC)
2026-08-19T14:32:10Z
Source
ct-log
Status
Unverified (T0)

Why it was flagged

Score breakdown Which signal contributed how many points
  • Character substitution against a monitored brand +40
  • Domain registered within the last 7 days +25
  • First certificate issued minutes ago +15
  • Login keyword appended to the brand name +11
  • Total 91

Network and location

IPv4
198.51.100.47 · 198.51.100.48
IPv6
2001:db8:4f2a::1
ASN
AS64512 · EXAMPLE-TRANSIT (belgeleme ASN'i)
Reverse DNS
web-047.pool.example-host.invalid
Hosting
Example Hosting B.V.
CDN
yok
Country
Hollanda (NL)
City
Amsterdam
Region
Noord-Holland
Coordinates
52.37 N, 4.90 E
Time zone
Europe/Amsterdam (UTC+02:00)
Collector zone
eu-west-1

Open services

PortStateServiceBanner
443openhttpsnginx
80openhttpnginx (301 → https)
22closedssh—
25filteredsmtp—

Certificate Transparency evidence

LogIndexTree sizeTimestampType
Google Xenon 20261,284,739,6211,284,739,7442026-08-19T14:31:58Zprecert
Cloudflare Nimbus 2026984,112,307984,112,4112026-08-19T14:32:03Zx509
DigiCert Yeti 2026447,290,183447,290,2662026-08-19T14:32:07Zx509

Certificate

Common name
northbay-login.top
Issuer
Example CA R3 (belgeleme)
Serial
04:9f:2a:c1:88:e0:31:7b:aa:42
Signature
ECDSA-SHA256
Key
EC P-256
Validity
90 days
Valid from
2026-08-19T14:28:00Z
Valid to
2026-11-17T14:27:59Z
Fingerprint
9f3c:41ab:77de:0025:b8a1:6f9c:22e4:1d70

Subject alternative names

  • northbay-login.top
  • www.northbay-login.top
  • secure.northbay-login.top
  • *.northbay-login.top

DNS records

TypeNameValueTTL
Anorthbay-login.top198.51.100.47300
Anorthbay-login.top198.51.100.48300
AAAAnorthbay-login.top2001:db8:4f2a::1300
NSnorthbay-login.topns1.example-dns.invalid86400
NSnorthbay-login.topns2.example-dns.invalid86400
MXnorthbay-login.top10 mail.example-host.invalid3600
TXTnorthbay-login.topv=spf1 include:_spf.example-host.invalid ~all3600
CAAnorthbay-login.top0 issue "example-ca.invalid"3600
SOAnorthbay-login.topns1.example-dns.invalid. abuse.example-dns.invalid. 20260819013600

Registration (RDAP)

Registered
2026-08-17T09:14:22Z
Age at detection
2 days
Registrar
Example Registrar Inc.
IANA ID
IANA 9999
Abuse e-mail
abuse@example-registrar.invalid
Abuse phone
+31 20 000 0000
Updated
2026-08-19T14:20:11Z
Expires
2027-08-17T09:14:22Z
Status
client transfer prohibited · ok

HTTP transaction

StepURLStatusLocation
1http://northbay-login.top/301https://northbay-login.top/
2https://northbay-login.top/302https://northbay-login.top/signin
3https://northbay-login.top/signin200—

Header

HeaderValue
servernginx
content-typetext/html; charset=utf-8
content-length18442
x-powered-byPHP/8.2.4
set-cookiesid=…; Path=/; HttpOnly
strict-transport-security— (yok)
content-security-policy— (yok)

Content fingerprint

Page title
Northbay · Secure Sign In
Size
18,442 bytes
Form target
https://northbay-login.top/api/auth
Form fields captured
email · password · otp

SHA-256 3f9a71c0d84e5b6621ff90ac3e1748d95b7a2c08e4f16d3b9c05a7e2d418c21b

  • logo.svg (meşru siteyle bit düzeyinde aynı)
  • app.css
  • app.js

What happened, when

Every step carries its own timestamp — nothing is reconstructed afterwards.

  1. 14:28:00 cert.issued Example CA R3
  2. 14:31:58 ct.logged Google Xenon 2026 #1284739621
  3. 14:32:03 ct.logged Cloudflare Nimbus 2026 #984112307
  4. 14:32:07 ct.logged DigiCert Yeti 2026 #447290183
  5. 14:32:10 collector.read os-worker/eu-west-1
  6. 14:32:10 score.computed 91 / 100
  7. 14:33:12 dns.resolved 2 A · 1 AAAA · 2 NS · 1 MX
  8. 14:33:19 rdap.fetched Example Registrar Inc.
  9. 14:33:30 http.fetched 200 · 3 adım yönlendirme
  10. 14:33:33 content.hashed sha256:3f9a…c21b
  11. 14:33:41 report.generated OS-F-2026-08-19-0417

Related findings

DomainIPCountryScoreFirst seen
northbay-secure.info198.51.100.47NL742026-08-19T14:31:22Z
n0rthbay.com203.0.113.19US882026-08-18T22:07:41Z
northbay.com.verify.top192.0.2.88DE692026-08-18T11:52:03Z
northbay-account.click198.51.100.47NL812026-08-17T18:33:57Z
northbay-verify.live203.0.113.19US772026-08-16T09:11:40Z

Where the cluster resolves

  • Hollanda NL 3
  • ABD US 2
  • Almanya DE 1
  • Singapur SG 1
  • Brezilya BR 1

Evidence package

Evidence completeness What the package contains and what it does not — 10/12

10 / 12 · %83

  • Domain and subdomains included
  • First-seen timestamp (UTC) included
  • Source reference (CT log) included
  • Certificate subject (CN/SAN) included
  • Signals behind the score included
  • Your legitimate domains included
  • DNS records (A/NS/MX) included
  • Registration date and registrar included
  • HTTP status and redirect chain included
  • Page content SHA-256 included
  • Independent third-party timestamp not available
  • Your identity / authorisation to report not available

The last two are yours to add: an abuse report needs the reporter's identity, and an independent archive link makes the timestamp harder to dispute.

What you can do next

Registrar abusefree · typically hours to 72 h · the fastest route
Hosting providerfree · needed when the registrar is slow
CDN (if fronted)free · they forward to the real host, they do not suspend
National CERTfree · restricts reachability within one country, not worldwide
UDRP / disputepaid · weeks · only when you want the domain itself

We do not file these for you. The package is built so that you — or your lawyer — can file them without chasing data.

Why a screenshot is not enough

A screenshot can be edited and its capture time cannot be proven. A certificate transparency entry cannot be altered after the fact, and a content hash lets anyone check later that the page has not changed. That is the difference between a claim and evidence.