Scan report · 20 days agoPublic

chefsavvy.com

104.18.37.69AS13335 · US
Verdict

Be careful — warning signs found

Automated

Its form submits what you type to a different website than the one you are on. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first
Suspicious fileSuspicious content in the downloaded file
bf8a0792-3e20-477b-bd53-184b0a6fdba9.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 05a59d718fc81e5e25cf7556ad6d867bf18f0248fb02113400d5ab48a9f968c1

SupportingScript loaded from a blob/data URL

A script was loaded from an in-memory blob:/data: URL, so its source never appears in network traffic — a common CSP/analysis-evasion technique.

Analyst noteRare on legitimate sites. Pair with decoded-then-executed payload or injected scripts to confirm obfuscation.

InfoBrand impersonation detected
Apple · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

InfoCross-domain scripts injected at runtime
9 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP
104.18.37.69CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS
CN=YE2, O=Let's Encrypt, C=US · expires Nov 6, 2026
Redirects
0 hops · / → /

WHOIS

Registrar
GoDaddy.com, LLC
Created
Jan 17, 2014
Expires
Jan 17, 2027
Nameservers
evan.ns.cloudflare.comlisa.ns.cloudflare.com
55 malicious13 suspicious

Hashes & fingerprints

Page capture

Live

Title “Delicious, Easy, Quick Weeknight Family Meals- Chef Savvy” · brand shown: Apple (low)

Engines

7 · time to verdict

Page

HTTP
200 · Completed
Title
Delicious, Easy, Quick Weeknight Family Meals- Chef Savvy
Load
2.15 s · 92 requests
Stack · 34AdThriveAppNexusCloudflareCloudflare Bot ManagementCloudflare Browser InsightsConvertKit