Scan report · 27 days agoPublic

www.temu.com

172.66.1.242AS13335 · US

Submittedhttps://www.temu.com/

Landed onhttps://www.temu.com/bgn_verification.html?verifyCode=jqYawKNZ5CBJY6fq5t3-SA9b75c71b1a0062f73&from=https%3A%2F%2Fwww.temu.com%2F&refer_page_name=home&refer_page_id=10005_1788809664941_m3kt2z2h9z&refer_page_sn=10005&_x_sessn_id=3ccgcuq426· 1 redirect

Verdict

1 of 7 enginesSuspiciousAutomated

Own this site?

Be careful — warning signs found

Automated

This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

5e5fe03b-70ab-42bc-9486-3e8ac5659989.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 9c153c96d9a3da9873bbc6e6f7ac18d6387a5c189e723aa5f53846d6460b32ae

InfoCross-domain scripts injected at runtime

12 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP: 172.66.1.242CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=GoDaddy TLS Intermediate CA DV - R1v1, O=GoDaddy.com, C=US · expires Jan 29, 2027
Redirects: 1 hop · / → /bgn_verification.html?verif…0005&_x_sessn_id=3ccgcuq426

WHOIS

Registrar: MarkMonitor Inc.
Created: Apr 29, 2003
Expires: Apr 29, 2030
Nameservers: ns1-35.azure-dns.comns2-35.azure-dns.netns3-35.azure-dns.orgns4-35.azure-dns.info

3 malicious16 suspicious

Hashes & fingerprints

Page Hashfb6f7a9c51de028f6ac3464296065ec0c2a5ee1b603485d9ced19718af4084cd Favicon Hashe083a3d7467ee285215bc0bf4e6ca1ad8dc60e28130f455d327900cd5558dfca DOM Hash211547f2150524832d289f394f76564b7f01e4129eac98f887e20fb322545a38 Screenshot pHashb2c84d374c96b2ea JARM29d3fd00029d29d21c42d43d00041d44609a5a9a88e797f466e878a82e8365 JA4Xa373a9f83c6b_7022c563de38_54872e220c05 Cert Thumbprint362469D1C8B8BDEC63C6C44B8AE4C139AAE72469 Cert IssuerCN=GoDaddy TLS Intermediate CA DV - R1v1, O=GoDaddy.com, C=US

Page capture

Live

Title “Säkerhetsverifiering”

Visit Site

Engines

7 · time to verdict