barclaysdownloads.com Open in urlscan Pro
104.25.152.27 Malicious Activity! Public Scan

URL:
https://barclaysdownloads.com/
Submission: On May 10 via manual (May 10th 2018, 2:35:02 pm UTC) from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 9 HTTP transactions. The main IP is 104.25.152.27, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is barclaysdownloads.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on May 10th 2018. Valid for: 6 months.

This is the only time barclaysdownloads.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Barclays (Banking)

Domain & IP information

	IP Address	AS Autonomous System
2	104.25.152.27 104.25.152.27	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	52.71.63.229 52.71.63.229	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
3	172.227.115.186 172.227.115.186	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	4

2 104.25.152.27 (San Francisco, United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

barclaysdownloads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.71.63.229 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-71-63-229.compute-1.amazonaws.com

secure.na1.echocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.227.115.186 (Cambridge, United States)

ASN20940 (AKAMAI-ASN1, US)
PTR: a172-227-115-186.deploy.static.akamaitechnologies.com

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	echocdn.com secure.na1.echocdn.com	81 KB
3	typekit.net use.typekit.net	228 KB
2	barclaysdownloads.com barclaysdownloads.com	10 KB
9	3

	Domain	Requested by
4	secure.na1.echocdn.com	barclaysdownloads.com
3	use.typekit.net	barclaysdownloads.com
2	barclaysdownloads.com	barclaysdownloads.com
9	3

This site contains no links.

Subject Issuer	Validity	Valid
ssl390319.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-05-10` - `2018-11-16`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://barclaysdownloads.com/
Frame ID: D413CD4DEF051903FF972EEE64ED6037
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

9
Requests

22 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

319 kB
Transfer

731 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
barclaysdownloads.com/ 22 KB
9 KB 111ms
69ms Document
text/html 104.25.152.27
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://barclaysdownloads.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.25.152.27 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f193f6d13af4981a81766959adf795b2ce206bfd9d76d6cf8780ee5bc25c04e7

Request headers

:method: GET
:authority: barclaysdownloads.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: D413CD4DEF051903FF972EEE64ED6037

Response headers

status: 200
date: Thu, 10 May 2018 14:34:51 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d50225493c0d7a9aca4decc6ed4edad771525962891; expires=Fri, 10-May-19 14:34:51 GMT; path=/; domain=.barclaysdownloads.com; HttpOnly; Secure
last-modified: Thu, 10 May 2018 11:55:18 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 418d2107583a2744-FRA
content-encoding: gzip

GET
H/1.1 200
OK grayskin.css
secure.na1.echocdn.com/resource/1978084650/style/ 13 KB
4 KB 432ms
100ms Stylesheet
text/css 52.71.63.229
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.na1.echocdn.com/resource/1978084650/style/grayskin.css

Requested by

Host: barclaysdownloads.com
URL: https://barclaysdownloads.com/

Protocol

HTTP/1.1

Server

52.71.63.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-71-63-229.compute-1.amazonaws.com

Software

Apache /

Resource Hash

62c883e8220b4cf973821263509a82d6ff23d72090ce87868d976eeba210b8f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://barclaysdownloads.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 14:34:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: Keep-Alive
X-XSS-Protection: 1; mode=block
Last-Modified: Sun, 06 Nov 2005 12:00:00 GMT
Server: Apache
ETag: 2740050219
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000;
Content-Type: text/css;charset=UTF-8
Cache-Control: public, max-age=315360000, post-check=315360000, pre-check=315360000
X-Robots-Tag: none
Keep-Alive: timeout=15, max=200
Expires: Wed, 10 May 2028 14:34:51 GMT

GET
H/1.1 200
OK echosign.css
secure.na1.echocdn.com/resource/N31624280/bundles/ 337 KB
56 KB 477ms
121ms Stylesheet
text/css 52.71.63.229
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.na1.echocdn.com/resource/N31624280/bundles/echosign.css

Requested by

Host: barclaysdownloads.com
URL: https://barclaysdownloads.com/

Protocol

HTTP/1.1

Server

52.71.63.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-71-63-229.compute-1.amazonaws.com

Software

Apache /

Resource Hash

7461899568dfc517b24071e8bc7b9a5bb0bcdd41a541bf9e239443a43c18d382

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://barclaysdownloads.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 14:34:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: Keep-Alive
X-XSS-Protection: 1; mode=block
Last-Modified: Sun, 06 Nov 2005 12:00:00 GMT
Server: Apache
ETag: 2740050219
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000;
Content-Type: text/css;charset=UTF-8
Cache-Control: public, max-age=315360000, post-check=315360000, pre-check=315360000
X-Robots-Tag: none
Keep-Alive: timeout=15, max=200
Expires: Wed, 10 May 2028 14:34:51 GMT

GET
H/1.1 200
OK esign.css
secure.na1.echocdn.com/resource/N2142260370/bundles/ 124 KB
18 KB 469ms
111ms Stylesheet
text/css 52.71.63.229
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.na1.echocdn.com/resource/N2142260370/bundles/esign.css

Requested by

Host: barclaysdownloads.com
URL: https://barclaysdownloads.com/

Protocol

HTTP/1.1

Server

52.71.63.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-71-63-229.compute-1.amazonaws.com

Software

Apache /

Resource Hash

8962cbf4e5012199494b43aad03f77d1dbb68015844c87a941bed6a2aec132d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://barclaysdownloads.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 14:34:51 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: Keep-Alive
X-XSS-Protection: 1; mode=block
Last-Modified: Sun, 06 Nov 2005 12:00:00 GMT
Server: Apache
ETag: 2740050219
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000;
Content-Type: text/css;charset=UTF-8
Cache-Control: public, max-age=315360000, post-check=315360000, pre-check=315360000
X-Robots-Tag: none
Keep-Alive: timeout=15, max=200
Expires: Wed, 10 May 2028 14:34:51 GMT

GET
H2 200 email-decode.min.js Show response
barclaysdownloads.com/cdn-cgi/scripts/f2bf09f8/cloudflare-static/ 1 KB
802 B 9ms
7ms Script
application/javascript 104.25.152.27
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://barclaysdownloads.com/cdn-cgi/scripts/f2bf09f8/cloudflare-static/email-decode.min.js

Requested by

Host: barclaysdownloads.com
URL: https://barclaysdownloads.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.25.152.27 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

d86535603bd79537d32a08e173e8b56877377941756eb8550b1c69b1d10c4dfe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:path: /cdn-cgi/scripts/f2bf09f8/cloudflare-static/email-decode.min.js
pragma: no-cache
cookie: __cfduid=d50225493c0d7a9aca4decc6ed4edad771525962891
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept: */*
cache-control: no-cache
:authority: barclaysdownloads.com
referer: https://barclaysdownloads.com/
:scheme: https
:method: GET
Referer: https://barclaysdownloads.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Thu, 10 May 2018 14:34:51 GMT
content-encoding: gzip
last-modified: Wed, 09 May 2018 11:00:10 GMT
server: cloudflare-nginx
etag: W/"5af2d4ba-441"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
content-type: application/javascript
status: 200
cache-control: max-age=172800 public
cf-ray: 418d2107e8792744-FRA
expires: Sat, 12 May 2018 14:34:51 GMT

GET
H/1.1 200
OK protected_document.png
secure.na1.echocdn.com/images/esign/ 3 KB
4 KB 108ms
107ms Image
image/png 52.71.63.229
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.na1.echocdn.com/images/esign/protected_document.png

Requested by

Host: barclaysdownloads.com
URL: https://barclaysdownloads.com/

Protocol

HTTP/1.1

Server

52.71.63.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-71-63-229.compute-1.amazonaws.com

Software

Apache /

Resource Hash

55d738a3a1280c90a20ae17260ee5a5a9509fd008a3b49fb92da922e62de8697

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://secure.na1.echocdn.com/resource/N31624280/bundles/echosign.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Thu, 10 May 2018 14:34:52 GMT
X-Content-Type-Options: nosniff
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Connection: Keep-Alive
Content-Length: 3145
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 16 Apr 2018 23:22:46 GMT
Server: Apache
ETag: W/"3145-1523920966000"
Strict-Transport-Security: max-age=31536000;
Content-Type: image/png;charset=UTF-8
Cache-Control: max-age=315360000
Accept-Ranges: bytes
X-Robots-Tag: none
Keep-Alive: timeout=15, max=199
Expires: Sun, 07 May 2028 14:34:52 GMT

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 84c858297d140080df2011346dee575ec7c5f0a7d016a50f21f7cbfb2cd998f0

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
S 200 l
use.typekit.net/af/24c826/000000000000000000017701/27/ 76 KB
76 KB 20ms
8ms Font
application/font-woff2 172.227.115.186
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/24c826/000000000000000000017701/27/l?primer=fff1a989570eb474b8c22c57cc7199e63bfc7e911b750165d0199218f0b7e7cc&fvd=n4&v=3
Requested by: Host: barclaysdownloads.com
URL: https://barclaysdownloads.com/
Protocol: SPDY
Server: 172.227.115.186 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a172-227-115-186.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 81999b137c804094867ada93df5d9f060c539be9ab07bcf2135edd8e502b32a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: https://barclaysdownloads.com/
Origin: https://barclaysdownloads.com

Response headers

date: Thu, 10 May 2018 14:34:52 GMT
server: nginx
etag: "0d996b878b7b398fd230d45744508dc8d99fec89"
status: 200, 200 OK
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=8640000
timing-allow-origin: *
content-length: 77772

GET
S 200 l
use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/ 74 KB
75 KB 25ms
18ms Font
application/font-woff2 172.227.115.186
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/c2b3ac/0000000000000000000176ff/27/l?primer=fff1a989570eb474b8c22c57cc7199e63bfc7e911b750165d0199218f0b7e7cc&fvd=n3&v=3
Requested by: Host: barclaysdownloads.com
URL: https://barclaysdownloads.com/
Protocol: SPDY
Server: 172.227.115.186 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a172-227-115-186.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: fbb461ad083a6933d65d1558861be443d69a13a3a331466f9822c4e6faacffd8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: https://barclaysdownloads.com/
Origin: https://barclaysdownloads.com

Response headers

date: Thu, 10 May 2018 14:34:52 GMT
server: nginx
etag: "c14f0262a116a62164e0ae0aa9a79bcb9d2a0a37"
status: 200, 200 OK
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=8640000
timing-allow-origin: *
content-length: 76200

GET
S 200 l
use.typekit.net/af/8f05ef/000000000000000000017703/27/ 77 KB
77 KB 18ms
18ms Font
application/font-woff2 172.227.115.186
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/8f05ef/000000000000000000017703/27/l?primer=fff1a989570eb474b8c22c57cc7199e63bfc7e911b750165d0199218f0b7e7cc&fvd=n7&v=3
Requested by: Host: barclaysdownloads.com
URL: https://barclaysdownloads.com/
Protocol: SPDY
Server: 172.227.115.186 Cambridge, United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a172-227-115-186.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 2c7b124a9eb927b63ad215e7bef2a271256ea915e0c413238f444f6564d7f194

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer: https://barclaysdownloads.com/
Origin: https://barclaysdownloads.com

Response headers

date: Thu, 10 May 2018 14:34:52 GMT
server: nginx
etag: "f6ff835f4fedc4ea2d1c860a6a52aa3e081ed82f"
status: 200, 200 OK
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=8640000
timing-allow-origin: *
content-length: 78788

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Barclays (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| downloadDoc

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.barclaysdownloads.com/	1970-01-19 00:38:18	Name: __cfduid Value: d50225493c0d7a9aca4decc6ed4edad771525962891

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

barclaysdownloads.com
secure.na1.echocdn.com
use.typekit.net
104.25.152.27
172.227.115.186
52.71.63.229
2c7b124a9eb927b63ad215e7bef2a271256ea915e0c413238f444f6564d7f194
55d738a3a1280c90a20ae17260ee5a5a9509fd008a3b49fb92da922e62de8697
62c883e8220b4cf973821263509a82d6ff23d72090ce87868d976eeba210b8f0
7461899568dfc517b24071e8bc7b9a5bb0bcdd41a541bf9e239443a43c18d382
81999b137c804094867ada93df5d9f060c539be9ab07bcf2135edd8e502b32a8
84c858297d140080df2011346dee575ec7c5f0a7d016a50f21f7cbfb2cd998f0
8962cbf4e5012199494b43aad03f77d1dbb68015844c87a941bed6a2aec132d2
d86535603bd79537d32a08e173e8b56877377941756eb8550b1c69b1d10c4dfe
f193f6d13af4981a81766959adf795b2ce206bfd9d76d6cf8780ee5bc25c04e7
fbb461ad083a6933d65d1558861be443d69a13a3a331466f9822c4e6faacffd8

barclaysdownloads.com Open in urlscan Pro 104.25.152.27 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

22 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

319 kBTransfer

731 kBSize

1 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

barclaysdownloads.com Open in urlscan Pro
104.25.152.27 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

22 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

319 kB
Transfer

731 kB
Size

1
Cookies

9 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!