technology software

e-commerce shopping

English

__cf_bm

Domain 'shop.whoop.com' uses the commercial generic top-level domain (.com); it also runs on subdomain 'shop'. Count 5 characters in 'whoop' holding two vowels versus 3 consonants. Breaking it apart gives one word: whoop. No strong language cues emerged from the frequency lists.

default-src 'none'; script-src 'nonce-HQl57an8l8xzqS25inkwbU' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'

default-src 'none'; script-src 'nonce-1uh0EL5ZFZaxF2bOnS917g' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'

default-src 'none'; script-src 'nonce-Jy8OJ8GcMMUVGTPCf5rfcn' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'

script-src 'unsafe-inline' 'unsafe-eval'; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=YEKo4gPyhZmcQQvw6rBttnM2kIZ4xDcV2AMtx5RLo6g-1786534911.9486508-1.0.1.1-OWhL8S0R7mrTPk7NSJv8iK94_BE.UktszEsAENrFaf0iCFwciIX9qoxRnUatFWnG3YaVcx3OofZocHZM714e1OxEaj3ufeHei8G8vZp.bulnIqwOF94syEfs4MF0hdRaOMcoW1Lxb73E0aDs8t1BvKGStH_03PQWchcfCLDdtFM; report-to cf-csp-endpoint

default-src 'none'; script-src 'nonce-jFEC3WpWtlTEwRTgEUvm8v' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self' https://hagen.challenges.cloudflare.com https://brunhild.challenges.cloudflare.com; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; trusted-types GAPH2 default; require-trusted-types-for 'script'; sandbox allow-same-origin allow-scripts allow-popups allow-forms

73eae66de9d6bd075350215e7cd4c97937840a75527ae854b3235cfc8bcf328e

247fca714ae128c981a0c12c1d7e10476b13d04a34d700a2798de1617ad3e816

af127a481aa491f7036767a7698acbd039403a58c5f7146be131cf99ac7d5e6d

robots

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

base-uri 'self'; connect-src 'self' whoop.com *.whoop.com amplitude.com *.amplitude.com api2.amplitude.com browser-intake-datadoghq.com *.browser-intake-datadoghq.com challenges.cloudflare.com datadoghq.com *.datadoghq.com http-intake.logs.datadoghq.com segment.com *.segment.com api.segment.io sentry.io *.sentry.io o217231.ingest.sentry.io stripe.com *.stripe.com contentful.com *.contentful.com cloudflarestream.com *.cloudflarestream.com whoop-inc.myshopify.com *.google-analytics.com analytics.google.com *.analytics.google.com smarty.com *.smarty.com *.okendo.io api.bazaarvoice.com google.com www.facebook.com connect.facebook.net ad.doubleclick.net www.googleadservices.com pagead2.googlesyndication.com *.g.doubleclick.net *.googletagmanager.com *.google.com *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.ie *.google.co.il *.google.im *.google.co.in *.google.iq *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.com.kh *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.com.ng *.google.com.ni *.google.ne *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.pl *.google.pn *.google.com.pr *.google.ps *.google.pt *.google.com.py *.google.com.qa *.google.ro *.google.ru *.google.rw *.google.com.sa *.google.com.sb *.google.sc *.google.se *.google.com.sg *.google.sh *.google.si *.google.sk *.google.com.sl *.google.sn *.google.so *.google.sm *.google.sr *.google.st *.google.com.sv *.google.td *.google.tg *.google.co.th *.google.com.tj *.google.tl *.google.tm *.google.tn *.google.to *.google.com.tr *.google.tt *.google.com.tw *.google.co.tz *.google.com.ua *.google.co.ug *.google.co.uk *.google.com.uy *.google.co.uz *.google.com.vc *.google.co.ve *.google.co.vi *.google.com.vn *.google.vu *.google.ws *.google.rs *.google.co.za *.google.co.zm *.google.co.zw *.google.cat; default-src 'self' whoop.com *.whoop.com; font-src 'self' bazaarvoice.com *.bazaarvoice.com typekit.net *.typekit.net fonts.gstatic.com data: cdn-static.okendo.io; frame-src 'self' challenges.cloudflare.com stripe.com *.stripe.com *.googletagmanager.com *.fls.doubleclick.net; frame-ancestors 'none'; img-src 'self' data: whoop.com *.whoop.com bazaarvoice.com *.bazaarvoice.com commercetools.com *.commercetools.com ctfassets.net *.ctfassets.net shopify.com *.shopify.com s3-us-west-2.amazonaws.com *.s3-us-west-2.amazonaws.com cloudflarestream.com *.cloudflarestream.com *.googletagmanager.com *.google-analytics.com ssl.gstatic.com www.gstatic.com *.okendo.io pagead2.googlesyndication.com ade.googlesyndication.com google.com www.facebook.com ad.doubleclick.net *.g.doubleclick.net www.googleadservices.com p.typekit.net *.google.com *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.ie *.google.co.il *.google.im *.google.co.in *.google.iq *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.com.kh *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.com.ng *.google.com.ni *.google.ne *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.pl *.google.pn *.google.com.pr *.google.ps *.google.pt *.google.com.py *.google.com.qa *.google.ro *.google.ru *.google.rw *.google.com.sa *.google.com.sb *.google.sc *.google.se *.google.com.sg *.google.sh *.google.si *.google.sk *.google.com.sl *.google.sn *.google.so *.google.sm *.google.sr *.google.st *.google.com.sv *.google.td *.google.tg *.google.co.th *.google.com.tj *.google.tl *.google.tm *.google.tn *.google.to *.google.com.tr *.google.tt *.google.com.tw *.google.co.tz *.google.com.ua *.google.co.ug *.google.co.uk *.google.com.uy *.google.co.uz *.google.com.vc *.google.co.ve *.google.co.vi *.google.com.vn *.google.vu *.google.ws *.google.rs *.google.co.za *.google.co.zm *.google.co.zw *.google.cat; media-src 'self' blob: ctfassets.net *.ctfassets.net cloudflarestream.com *.cloudflarestream.com; script-src 'self' 'unsafe-inline' whoop.com *.whoop.com apps.bazaarvoice.com *.bazaarvoice.com cdn-static.okendo.io okendo.io *.okendo.io cdn.amplitude.com amplitude.com *.amplitude.com cdn.segment.com segment.com *.segment.com challenges.cloudflare.com cloudflare.com *.cloudflare.com d3hw6dc1ow8pp2.cloudfront.net js.stripe.com stripe.com *.stripe.com datadoghq-browser-agent.com *.datadoghq-browser-agent.com sentry.io *.sentry.io typekit.net *.typekit.net *.googletagmanager.com tagmanager.google.com www.google.com pagead2.googlesyndication.com connect.facebook.net www.googleadservices.com googleads.g.doubleclick.net; style-src 'self' 'unsafe-inline' typekit.net *.typekit.net *.googletagmanager.com tagmanager.google.com fonts.googleapis.com cdn-static.okendo.io; worker-src 'self' blob:; upgrade-insecure-requests; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=Fdf1Tx3qV_HrYk4m.Ai0Tr09Wb.FBa6q61GZ4qwnv04-1786534988.0629973-1.0.1.1-hJoSIUI66CHhq_noHk1HrWcTVe9u9xGxsu9BUntvlziE.DJtSNy5JDrrhFHoNw91pWxy6K1mfU8RVBtDSIRTJBpyDhW1NytC3JWrRCIFVMbiHaBi1ci1gTiVRvD4vDSa8t7v4fR_qFe.Wt1Cbyn1Q7WbvjfkLGEQJo0jR2JNqS7bxYsLRWVB8HjzjjmWVH1bq.dl8E73_PpswL4G6Np1oQ; report-to cf-wheiixzcvsxhvutg

GoDaddy.com, LLC

WHOOP.COM

Cloudflare, Inc.

Cloudflare, Inc

CLOUDFLARENET

Requests	IP Address	Location	AS Autonomous System
4	13.33.187.102Cloudfront · CDN	New York, New York, United States	AS16509Amazon.com, Inc.
3	65.9.130.79Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
3	172.64.153.33Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
10	3	-	-

Security Scan Report: shop.whoop.com

Summary

AI Security Verdict

Safe Website

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History