Security Scan Report: goupon.se

Redirected to:
https://www.groupon.es/
Site favicon
Submitted: Completed: publiccompleted
This website contacted 78 IPs in 5 countries across 57 domains to perform 102 HTTP transactions. The main domain is goupon.se.

Submitted URL: https://goupon.se

Effective URL:
https://www.groupon.es/
Redirected

AI Security Verdict

Moderate Risk

Confidence: 60%

4
Risk Score

A lookalike hostname (goupon.se) redirects to the genuine www.groupon.es, which served only a bot-block status page. No forms, no credential capture and no threat-intel hits; the typosquat entry domain is the sole concern.

Risk Factors (2)
Deceptive lookalike entry hostname (goupon.se vs. groupon) used to funnel traffic — consistent with typosquat/affiliate traffic monetisation
Cross-domain redirect from the lookalike domain to the real brand site
Safety Factors (4)
Final destination is the legitimate Groupon domain and serves Groupon's own block/status page
No forms of any kind on the page — no credentials or payment data can be captured
No threat-intelligence, hunting rule, kit-roster or JavaScript behaviour findings
Redirection to the genuine brand site means a visitor is not exposed to a phishing kit
Domain age information unavailable

Details

Page Title

Groupon Status Page | Access Restricted

Scan Type

public

Domain Name Analysis

Domain 'goupon.se' uses the Swedish country-code top-level domain (.se) and has no subdomain. Count 6 characters in 'goupon' with 3 vowels and 3 consonants. Segmentation suggests 2 words: go, upon. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://goupon.se

Page Load Overview

5.72s
Total Load Time
1.5 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:496 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: spa
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
25104.18.5.175Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.22.238Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.0.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1104.18.1.117Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1172.64.155.119Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.14.97Google · CDNUnited States
AS15169Google LLC
118.172.112.66Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
1104.18.12.36Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
134.96.75.226Google · CDNKansas City, Missouri, United States
AS396982Google LLC
1142.251.127.84Google · CDNUnited States
AS15169Google LLC
10278--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T11564E0B46327407451D30994B1AF7649FDB9AA136400D098BAFC89E5AFACF8D6432F7C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

6144:i35cYuI8b7jf7Ir1QUyXcWbFI81o2YpuE3gsPBHxnIJbIO:i3Z4QxTyXcWpI8zIosPbnIJbIO

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:313378:SVhCEAWBKvyAMDxi6MhWIBESmAh0J0QIJIRQ+rUQIAhFDAJDBgBFpKFT4hU0AEqgsNAoLYMIgVC0hCACAkXYEGGQiHQRIUAy

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:dfc7c3dfffffffff
Perceptual Hash:b838c7c7c7c73038
Difference Hash:30b6b63420000000
Wavelet Hash:1f4301030060f0f0
Color Hash:N/A

Other Hashes

Scan History

Scan history not available

Unable to load historical scan data