ScanMalware.com

Statistics

What ScanMalware saw in the last 24 hours: the infrastructure behind malicious websites, the threats they carry, and where scanned URLs come from.

Public scans
5,806
4,728 distinct sites
Malicious scans
1,666
28.7% of public scans
Malicious sites
1,271
distinct hostnames

Scans and malicious scans

All public scans per hour (UTC)

MaliciousOther scans
Hover a column for details ยท peak 489
10-31 14:00 UTC11-01 14:00 UTC
Show as table
PeriodScansMalicious
10-31 14:00 UTC145
10-31 15:00 UTC240116
10-31 16:00 UTC22488
10-31 17:00 UTC16941
10-31 18:00 UTC16044
10-31 19:00 UTC17557
10-31 20:00 UTC15536
10-31 21:00 UTC14326
10-31 22:00 UTC15934
10-31 23:00 UTC16036
11-01 00:00 UTC23677
11-01 01:00 UTC489144
11-01 02:00 UTC306117
11-01 03:00 UTC31282
11-01 04:00 UTC35388
11-01 05:00 UTC31773
11-01 06:00 UTC18530
11-01 07:00 UTC22634
11-01 08:00 UTC24255
11-01 09:00 UTC22760
11-01 10:00 UTC25256
11-01 11:00 UTC23941
11-01 12:00 UTC300110
11-01 13:00 UTC302149
11-01 14:00 UTC22167

IP addresses hosting the most malicious sites

Distinct malicious hostnames per IP address

IP addressNetworkSites
๐Ÿ‡บ๐Ÿ‡ธ199.36.158.100CDNAS54113 Fastly, Inc.150
๐Ÿ‡บ๐Ÿ‡ธ188.114.97.3CDNAS13335 Cloudflare, Inc.136
๐Ÿ‡บ๐Ÿ‡ธ188.114.96.3CDNAS13335 Cloudflare, Inc.120
๐Ÿ‡บ๐Ÿ‡ธ172.238.172.122AS63949 Akamai Connected Cloud61
๐Ÿ‡บ๐Ÿ‡ธ104.18.54.45CDNAS13335 Cloudflare, Inc.53
๐Ÿ‡บ๐Ÿ‡ธ172.236.104.157AS63949 Akamai Connected Cloud51
๐Ÿ‡บ๐Ÿ‡ธ104.18.50.34CDNAS13335 Cloudflare, Inc.49
๐Ÿ‡บ๐Ÿ‡ธ172.236.104.43AS63949 Akamai Connected Cloud47
๐Ÿ‡ญ๐Ÿ‡ฐ216.118.238.229AS45753 Netsec Limited18
๐Ÿ‡ฉ๐Ÿ‡ช35.157.26.135CDNAS16509 Amazon.com, Inc.18
๐Ÿ‡บ๐Ÿ‡ธ64.29.17.195CDNAS16509 Amazon.com, Inc.18
๐Ÿ‡บ๐Ÿ‡ธ216.198.79.195CDNAS16509 Amazon.com, Inc.16
๐Ÿ‡บ๐Ÿ‡ธ64.29.17.131CDNAS16509 Amazon.com, Inc.15
๐Ÿ‡บ๐Ÿ‡ธ216.198.79.131CDNAS16509 Amazon.com, Inc.14
๐Ÿ‡บ๐Ÿ‡ธ216.198.79.67CDNAS16509 Amazon.com, Inc.14

Networks (ASNs) with the most malicious sites

Distinct malicious hostnames per network

  1. AS13335 Cloudflare, Inc.
    604
  2. AS54113 Fastly, Inc.
    158
  3. AS63949 Akamai Connected Cloud
    140
  4. AS16509 Amazon.com, Inc.
    114
  5. AS45753 Netsec Limited
    20
  6. AS153656 OWGELS INTERNATIONAL CO., LIMITED
    11
  7. AS62370 Snel.com B.V.
    11
  8. AS139341 ACE
    9
  9. AS153947 FAST ZONE IT
    9
  10. AS16276 OVH SAS
    9
  11. AS396982 Google LLC
    9
  12. AS34119 Wildcard UK Limited
    8
  13. AS31898 Oracle Corporation
    7
  14. AS8075 Microsoft Corporation
    7
  15. AS14061 DigitalOcean, LLC
    6

Domains with the most malicious subdomains

Distinct malicious subdomains under one registered domain

  1. gdmaoka.com
    18
  2. edgeone.dev
    7
  3. sanpinjia.com
    7
  4. gitbook.io
    4
  5. spheremama.com
    4
  6. weebly.com
    4
  7. mizuhoscfglobal.com
    3
  8. adilawa99.org
    2
  9. cr-web.workers.dev
    2
  10. dpmz.top
    2
  11. edgeone.app
    2
  12. iceiy.com
    2
  13. tyhx.my.id
    2
  14. wasmer.app
    2
  15. 10001slot.org
    1

Hosting platforms most abused

Malicious sites on free-subdomain and app-hosting platforms

  1. pages.dev
    269
  2. r2.dev
    101
  3. web.app
    83
  4. vercel.app
    79
  5. firebaseapp.com
    68
  6. netlify.app
    26
  7. workers.dev
    18
  8. blogspot.com
    4
  9. github.io
    4
  10. onrender.com
    3
  11. replit.app
    2
  12. typedream.app
    2
  13. azurefd.net
    1
  14. cloudfront.net
    1
  15. dpdns.org
    1

Threat types

Malicious scans by the kind of threat found

  1. Credential Phishing
    697
  2. Brand Impersonation
    326
  3. Malware Distribution
    311
  4. Other
    126
  5. Investment/Crypto Scam
    37
  6. Illegal Gambling
    17
  7. Survey/Reward Scam
    5
  8. Tech Support Scam
    3
  9. Fake Shopping
    1

Top-level domains of malicious sites

Distinct malicious hostnames per TLD

  1. .dev
    395
  2. .com
    277
  3. .app
    198
  4. .top
    179
  5. .net
    25
  6. .org
    22
  7. .info
    13
  8. .io
    12
  9. .live
    8
  10. .cc
    7
  11. .at
    6
  12. .id
    5
  13. .it
    5
  14. .vip
    5
  15. .br
    4

Countries hosting the most malicious sites

Country of the hosting IP address. The second column leaves out shared CDN addresses, whose location is the network's, not the site's server.

CountryAll sitesExcl. CDN
๐Ÿ‡บ๐Ÿ‡ธ United States1,062189
๐Ÿ‡ฉ๐Ÿ‡ช Germany5224
๐Ÿ‡ญ๐Ÿ‡ฐ Hong Kong3837
๐Ÿ‡ณ๐Ÿ‡ฑ Netherlands2218
๐Ÿ‡ซ๐Ÿ‡ท France1515
๐Ÿ‡ฌ๐Ÿ‡ง United Kingdom1212
๐Ÿ‡ธ๐Ÿ‡ฌ Singapore1212
๐Ÿ‡น๐Ÿ‡ท Turkey1111
๐Ÿ‡ฏ๐Ÿ‡ต Japan109
๐Ÿ‡ท๐Ÿ‡บ Russia77
๐Ÿ‡ฎ๐Ÿ‡น Italy44
๐Ÿ‡ฆ๐Ÿ‡บ Australia33
๐Ÿ‡ฆ๐Ÿ‡ท Argentina22
๐Ÿ‡จ๐Ÿ‡ฆ Canada22
๐Ÿ‡ฉ๐Ÿ‡ฐ Denmark22

Countries hosting the most malicious sites (own servers)

Sites not behind a shared CDN, by the country of their server

  1. ๐Ÿ‡บ๐Ÿ‡ธ United States
    189
  2. ๐Ÿ‡ญ๐Ÿ‡ฐ Hong Kong
    37
  3. ๐Ÿ‡ฉ๐Ÿ‡ช Germany
    24
  4. ๐Ÿ‡ณ๐Ÿ‡ฑ Netherlands
    18
  5. ๐Ÿ‡ซ๐Ÿ‡ท France
    15
  6. ๐Ÿ‡ฌ๐Ÿ‡ง United Kingdom
    12
  7. ๐Ÿ‡ธ๐Ÿ‡ฌ Singapore
    12
  8. ๐Ÿ‡น๐Ÿ‡ท Turkey
    11
  9. ๐Ÿ‡ฏ๐Ÿ‡ต Japan
    9
  10. ๐Ÿ‡ท๐Ÿ‡บ Russia
    7
  11. ๐Ÿ‡ฎ๐Ÿ‡น Italy
    4
  12. ๐Ÿ‡ฆ๐Ÿ‡บ Australia
    3
  13. ๐Ÿ‡ฆ๐Ÿ‡ท Argentina
    2
  14. ๐Ÿ‡จ๐Ÿ‡ฆ Canada
    2
  15. ๐Ÿ‡ฉ๐Ÿ‡ฐ Denmark
    2

Cities hosting the most malicious sites

Sites not behind a shared CDN, by the city of their server. The city is known for 242 of 365 such sites.

  1. ๐Ÿ‡บ๐Ÿ‡ธ Chicago ยท United States
    140
  2. ๐Ÿ‡ญ๐Ÿ‡ฐ Hong Kong ยท Hong Kong
    13
  3. ๐Ÿ‡ฉ๐Ÿ‡ช Frankfurt am Main ยท Germany
    12
  4. ๐Ÿ‡บ๐Ÿ‡ธ Phoenix ยท United States
    6
  5. ๐Ÿ‡ฏ๐Ÿ‡ต Tokyo ยท Japan
    6
  6. ๐Ÿ‡ณ๐Ÿ‡ฑ Amsterdam ยท Netherlands
    5
  7. ๐Ÿ‡ฎ๐Ÿ‡น Arezzo ยท Italy
    4
  8. ๐Ÿ‡ซ๐Ÿ‡ท Lauterbourg ยท France
    4
  9. ๐Ÿ‡บ๐Ÿ‡ธ Ashburn ยท United States
    3
  10. ๐Ÿ‡บ๐Ÿ‡ธ Las Vegas ยท United States
    3
  11. ๐Ÿ‡ธ๐Ÿ‡ฌ Singapore ยท Singapore
    3
  12. ๐Ÿ‡ฉ๐Ÿ‡ฐ Copenhagen ยท Denmark
    2
  13. ๐Ÿ‡บ๐Ÿ‡ธ Dallas ยท United States
    2
  14. ๐Ÿ‡ฉ๐Ÿ‡ช Falkenstein ยท Germany
    2
  15. ๐Ÿ‡บ๐Ÿ‡ธ Miami ยท United States
    2

Countries submitting the most URLs

Ranked by URLs submitted by people. Excludes ScanMalware's own automated scanning.

  1. 1.๐Ÿ‡ฌ๐Ÿ‡ง United Kingdom
  2. 2.๐Ÿ‡บ๐Ÿ‡ธ United States
  3. 3.๐Ÿ‡ฉ๐Ÿ‡ช Germany
  4. 4.๐Ÿ‡ซ๐Ÿ‡ฎ Finland
  5. 5.๐Ÿ‡จ๐Ÿ‡ฆ Canada
  6. 6.๐Ÿ‡ต๐Ÿ‡ฐ Pakistan
  7. 7.๐Ÿ‡ป๐Ÿ‡ณ Vietnam
  8. 8.๐Ÿ‡ฉ๐Ÿ‡ฟ Algeria
  9. 9.๐Ÿ‡ช๐Ÿ‡ธ Spain
  10. 10.๐Ÿ‡ฎ๐Ÿ‡ฑ Israel
  11. 11.๐Ÿ‡ฏ๐Ÿ‡ต Japan
  12. 12.๐Ÿ‡ฑ๐Ÿ‡น Lithuania
  13. 13.๐Ÿ‡ฒ๐Ÿ‡พ Malaysia
  14. 14.๐Ÿ‡ณ๐Ÿ‡ฑ Netherlands
  15. 15.๐Ÿ‡ณ๐Ÿ‡ด Norway
  16. 16.๐Ÿ‡ท๐Ÿ‡ด Romania

Site traffic

Counted from 2026-10-31 (UTC). Scan views and visitors count people only: search engines, other crawlers and automated clients are left out.

Most viewed scans

Public scan results ranked by the number of people who opened them

  1. 1.laredonda.futbolSign in - Google Accounts
  2. 2.sunny-orchard-e409-cb22d65f.pages.devะขะต๏ฟฝ๏ฟฝั‚ ัะบะพั€ะพัั‚ะธ ะธะฝั‚ะตั€ะฝะตั‚ะฐ โ€” ะธะทะผะตั€ะตะฝะธะต ะฟั€ะพะธะทะฒะพะดะธั‚ะตะปัŒะฝะพัั‚ะธ ัะตั‚ะธ | Cloudflare
  3. 3.olive-otter-03bf-1e835a04.pages.devInternetgeschwindigkeitstest โ€“ Netzwerkleistung messen | Cloudflare
  4. 4.frosty-finch-46f6.pages.devใ‚คใƒณใ‚ฟใƒผใƒใƒƒใƒˆใ‚นใƒ”ใƒผใƒ‰ใƒ†ใ‚นใƒˆ - ใƒใƒƒใƒˆใƒฏใƒผใ‚ฏใƒ‘ใƒ•ใ‚ฉใƒผใƒžใƒณใ‚นใฎๆธฌๅฎš | Cloudflare
  5. 5.gentle-field-7f01-a4905fc3.pages.devInternet Speed Test - Measure Network Performance | Cloudflare
  6. 6.azure-lark-a2ac-b8fc3271.pages.devCloudflare Speed Test ์†Œ๊ฐœ | Cloudflare
  7. 7.etherdancer.comEtherdancer | Free Simple Tools โ€” No Signup, No Upload, No Tracking
  8. 8.cazmireqo.netCazmireqo โ€” AI Platform for Freelance Capital Decisions
  9. 9.facebook--security-wizard-zoom-zoomed.phRedirecting...
  10. 10.gentle-field-7f01-a4905fc3.pages.dev็ถฒ้š›็ถฒ่ทฏๆธฌ้€Ÿ - ๆธฌ้‡็ถฒ่ทฏๆ•ˆ่ƒฝ | Cloudflare
  11. 11.minty-field-23c7-dc0e6957.pages.devInternet Speed Test - Measure Network Performance | Cloudflare
  12. 12.neodigitalshop.storeNeoDigital Shop
  13. 13.we-magnus-dp64fh1kwyeb.edgeone.devWeMagnus ไบบๆœบๅฏนๆˆ˜
  14. 14.energeek-landingpages-git-7bf186-professor-energeek-s-projects.vercel.appLogin โ€“ Vercel
  15. 15.mellow-heron-0d2a-92c803b0.pages.devCloudflare Speed Test ์†Œ๊ฐœ | Cloudflare

Countries visitors come from

Ranked by the number of people visiting ScanMalware

  1. 1.๐Ÿ‡บ๐Ÿ‡ธ United States
  2. 2.๐Ÿ‡ซ๐Ÿ‡ท France
  3. 3.๐Ÿ‡ฌ๐Ÿ‡ง United Kingdom
  4. 4.๐Ÿ‡ฉ๐Ÿ‡ช Germany
  5. 5.๐Ÿ‡ง๐Ÿ‡ท Brazil
  6. 6.๐Ÿ‡ช๐Ÿ‡ธ Spain
  7. 7.๐Ÿ‡ธ๐Ÿ‡ฌ Singapore
  8. 8.๐Ÿ‡จ๐Ÿ‡ฆ Canada
  9. 9.๐Ÿ‡ฒ๐Ÿ‡พ Malaysia
  10. 10.๐Ÿ‡ฎ๐Ÿ‡น Italy
  11. 11.๐Ÿ‡ป๐Ÿ‡ณ Vietnam
  12. 12.๐Ÿ‡ต๐Ÿ‡น Portugal
  13. 13.๐Ÿ‡จ๐Ÿ‡ณ China
  14. 14.๐Ÿ‡ณ๐Ÿ‡ฑ Netherlands
  15. 15.๐Ÿ‡น๐Ÿ‡ผ Taiwan
  16. 16.๐Ÿ‡ฆ๐Ÿ‡ท Argentina
  17. 17.๐Ÿ‡ฎ๐Ÿ‡ฑ Israel
  18. 18.๐Ÿ‡ญ๐Ÿ‡ฐ Hong Kong
  19. 19.๐Ÿ‡ฒ๐Ÿ‡ฝ Mexico
  20. 20.๐Ÿ‡ช๐Ÿ‡จ Ecuador

Most requested registered domains via the API

Lookups grouped by registered domain

  1. kpmg.com
    122,775
  2. bmwgroup.com
    53,558
  3. pvp.net
    37,728
  4. bmw.com
    33,062
  5. jnj.com
    13,931
  6. kpmg.com.au
    11,972
  7. kpmg.de
    8,140
  8. wjunction.com
    7,616
  9. grandlyon.com
    7,006
  10. blackstone.com
    6,778
  11. snowflakecomputing.com
    6,300
  12. kpmg.fr
    6,170
  13. magento.com
    5,935
  14. 91aql.com
    5,590
  15. eldoradobrasil.com.br
    5,354

Busiest API endpoints

API requests by endpoint (our own systems excluded)

  1. /api/v1/search/smql
    1,999,090
  2. /api/v1/ct/dns/{host}
    1,976,114
  3. /api/v1/hosts/{host}
    1,974,697
  4. /api/v1/rdap/{id}
    26,178
  5. /api/v1/domain/history/{host}
    23,170
  6. /api/v1/domain/stats/{host}
    22,364
  7. /api/v1/ct/{host}
    18,071
  8. /api/v1/favicon/{id}
    16,222
  9. /api/v1/result/{id}
    15,877
  10. /api/v1/ioc/{id}
    15,757
  11. /api/v1/js-fingerprinting3/scan/{id}
    15,609
  12. /api/v1/rpki/{id}
    15,575
  13. /api/v1/tls/{id}
    15,522
  14. /api/v1/scans/{id}/jsfingerprints
    15,494
  15. /api/v1/jarm/scan/{id}
    15,341

JavaScript

Scripts loaded by the 2,500 websites scanned in the last 24 hours, counted as the number of distinct websites. Third-party means the script comes from a different registered domain than the page.

Most popular libraries and frameworks

Websites where the library or framework was detected

  1. jQuery ยท JavaScript library
    518
  2. Bootstrap ยท UI framework
    246
  3. jQuery Migrate ยท JavaScript library
    189
  4. React ยท JavaScript framework
    127
  5. Vue.js ยท JavaScript framework
    56
  6. Next.js ยท JavaScript framework
    45
  7. Swiper ยท JavaScript library
    41
  8. Underscore.js ยท JavaScript library
    34
  9. OWL Carousel ยท JavaScript library
    33
  10. Slick ยท JavaScript library
    29
  11. Lodash ยท JavaScript library
    26
  12. jQuery UI ยท JavaScript library
    25
  13. Lightbox ยท JavaScript library
    25
  14. Modernizr ยท JavaScript library
    24
  15. imagesLoaded ยท JavaScript library
    22

Most used third-party script providers

Registered domain serving the script

  1. cloudflare.com
    605
  2. googletagmanager.com
    464
  3. parklogic.com
    461
  4. facebook.net
    166
  5. google.com
    160
  6. gstatic.com
    142
  7. jsdelivr.net
    116
  8. ajax.googleapis.com
    106
  9. doubleclick.net
    102
  10. jquery.com
    92
  11. google-analytics.com
    87
  12. clarity.ms
    72
  13. cloudflareinsights.com
    63
  14. googlesyndication.com
    49
  15. maps.googleapis.com
    47

Most loaded third-party scripts

Script URL without its query string

  1. parking3.parklogic.com/page/enhance.js
    461
  2. challenges.cloudflare.com/turnstile/v0/g/c787ce48cf6b/api.js
    460
  3. www.googletagmanager.com/gtag/js
    433
  4. challenges.cloudflare.com/turnstile/v0/api.js
    412
  5. www.googletagmanager.com/gtm.js
    215
  6. connect.facebook.net/en_US/fbevents.js
    144
  7. www.google-analytics.com/analytics.js
    74
  8. www.google.com/recaptcha/api.js
    71
  9. static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092
    55
  10. ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
    51
  11. scripts.clarity.ms/0.8.77-beta/clarity.js
    48
  12. code.jquery.com/jquery-3.1.1.min.js
    47
  13. maps.googleapis.com/maps/api/js
    47
  14. cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
    45
  15. ep2.adtrafficquality.google/sodar/sodar2.js
    44

Most common first-party scripts

Script path served from the website's own domain

  1. /wp-includes/js/jquery/jquery-migrate.min.js
    165
  2. /wp-includes/js/jquery/jquery.min.js
    164
  3. /wp-includes/js/wp-emoji-release.min.js
    141
  4. /sw.js
    92
  5. /wp-includes/js/dist/i18n.min.js
    92
  6. /wp-includes/js/dist/hooks.min.js
    91
  7. /cdn-cgi/challenge-platform/h/g/scripts/jsd/c787ce48cf6b/main.js
    89
  8. /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
    89
  9. /sw-register.js
    67
  10. /wp-includes/js/jquery/ui/core.min.js
    65
  11. /_next/static/chunks/polyfills-42372ed130431b0a.js
    60
  12. /assets/* (13 files)
    58
  13. /wp-content/plugins/contact-form-7/includes/js/index.js
    54
  14. /_next/static/chunks/0cz1d0mv5g_q7.js
    53
  15. /assets/_index-4LrXcPzI.js
    52

TLS server fingerprints

JARM and JA4S describe how a web server answers a TLS connection; servers running the same software and configuration share a fingerprint. Counted as distinct websites. The malicious rankings order fingerprints by the share of their websites that were malicious (at least 10 websites, 5 of them malicious). JA4S is recorded since 23 September 2026.

Most common JARM fingerprints

FingerprintUsual networkSitesMalicious
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCloudflare, Inc.1,673286 (17%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.722328 (45%)
27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5Akamai Connected Cloud523137 (26%)
27d40d40d00040d00041d41d00041d5c54a1f00e65091ffab50f9203d10672Fastly, Inc.392151 (39%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.297107 (36%)
29d29d00029d29d00041d41d00041db78309d03c04b7072bacbf1ce396279bAmazon.com, Inc.23234 (15%)
27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.16332 (20%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.152101 (66%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.12646 (37%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC9746 (47%)
2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06bMicrosoft Corporation8226 (32%)
29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36cFastly, Inc.7920 (25%)
29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84Google LLC7812 (15%)
2ad2ad0002ad2ad22c42d42d0000008a5941c13f67e0c0a2c8a36bfeef6920ACE607 (12%)
29d29d00029d29d21c41d41d00041d38d8d683f08c154e73a9de64943d64e4Amazon.com, Inc.5917 (29%)

JARM fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
3fd3fd0003fd3fd00042d43d0000002059a3b916699461c5923779b77cf06bNetsec Limited2422 (92%)
3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763OWGELS INTERNATIONAL CO., LIMITED1614 (88%)
27d40d40d00040d1dc42d43d00041d5691268beec3bcca1d5ab3aacc89645fCloudflare, Inc.152101 (66%)
29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1Oracle Corporation2314 (61%)
3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06bCloudflare, Inc.169 (56%)
29d29d00029d29d00042d43d00041d5de67cc9954cc85372523050f20b5007Cloudflare, Inc.2513 (52%)
2ad2ad0002ad2ad22c42d42d000000307ee0eb468e9fdb5cfcd698a80a67efHostPapa126 (50%)
27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36cGoogle LLC9746 (47%)
27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6Cloudflare, Inc.722328 (45%)
28d28d28d2ad28d1dc42d42d00042ded961c16c68658e95145597cf992c36cGoogle LLC188 (44%)
28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08dAkamai International B.V.2511 (44%)
27d40d40d00040d1dc27d40d27d40d5fb4c89fe3813d172ffb53f84a68f750Cloudflare, Inc.156 (40%)
27d40d40d00040d00041d41d00041d5c54a1f00e65091ffab50f9203d10672Fastly, Inc.392151 (39%)
40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319Amazon.com, Inc.12646 (37%)
3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fbAmazon.com, Inc.297107 (36%)

Most common JA4S fingerprints

FingerprintUsual networkSitesMalicious
t130200_1302_234ea6891581Cloudflare, Inc.3,194879 (28%)
t130200_1302_a56c5b993250Akamai Connected Cloud1,617417 (26%)
t130200_1301_a56c5b993250Fastly, Inc.933245 (26%)
t130200_1303_a56c5b993250Amazon.com, Inc.468166 (35%)
t1206h2_c02f_3603f09c43baAmazon.com, Inc.474 (9%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.197 (37%)
t1207h1_c02f_b948729f6510Hangzhou Alibaba Advertising Co.,Ltd.170 (0%)
t1206h2_c02f_3f14cc51fb76Fastly, Inc.162 (13%)
t1207h1_c030_b948729f6510Amazon.com, Inc.141 (7%)
t1207h2_c030_b948729f6510GoDaddy.com, LLC137 (54%)
t1207h2_c02f_b948729f6510Amazon.com, Inc.113 (27%)
t1204h2_c030_b252f78b95f6Amazon.com, Inc.102 (20%)
t130200_1301_234ea6891581SiteVision AB92 (22%)
t120300_c02f_460f64128655Adobe Inc.70 (0%)
t1207h1_c02c_b948729f6510Netsec Limited65 (83%)

JA4S fingerprints most associated with malicious sites

FingerprintUsual networkSitesMalicious
t1207h2_c030_b948729f6510GoDaddy.com, LLC137 (54%)
t1206h2_c02b_3f14cc51fb76Cloudflare, Inc.197 (37%)
t130200_1303_a56c5b993250Amazon.com, Inc.468166 (35%)
t130200_1302_234ea6891581Cloudflare, Inc.3,194879 (28%)
t130200_1301_a56c5b993250Fastly, Inc.933245 (26%)
t130200_1302_a56c5b993250Akamai Connected Cloud1,617417 (26%)

A scan counts as malicious when our AI verdict rates it Confirmed scam or High risk, or our rule-based verdict rates it Malicious. Threat statistics cover all public scans; the submitting-country ranking covers URLs submitted by people and excludes ScanMalware's own automated scanning. Unlisted and private scans are never shown individually. Refreshed every 30โ€“60 minutes depending on the window ยท generated 2026-11-01 14:53 UTC.