Just a moment...

entertainment media

adult content

documentation technical

technology software

e-commerce

English

__cf_bm

The domain 'www.bigbadtoystore.com' uses the commercial generic top-level domain (.com) with subdomain 'www'. Count 14 characters in 'bigbadtoystore' containing five vowels alongside nine consonants. It segments into 4 words: big, bad, toy, store. Expect 3 characters per word on average. No strong language cues emerged from the frequency lists.

html/b1/6f/b16ff3fe-b265-418f-b206-f2909fffef25.html.gz

connect-src 'self' *.google.com google.com *.bing.com https://*.paypal.com https://*.paypalobjects.com *.braintree-api.com *.braintreegateway.com *.google-analytics.com *.doubleclick.net *.visualstudio.com *.cloudfront.net *.helpscout.net *.cookielaw.org *.googleadservices.com *.mmapiws.com *.onetrust.com *.youtube.com *.googlesyndication.com *.redditstatic.com *.reddit.com *.googletagmanager.com *.tiktok.com wss://ws.hotjar.com *.hotjar.io *.facebook.com https://*.amplitude.com; default-src 'self'; font-src 'self' https://fonts.gstatic.com https://fonts.cdnfonts.com data: https://*.paypalobjects.com; frame-src 'self' *.paypal.com *.braintreegateway.com *.doubleclick.net *.googleadservices.com *.googlesyndication.com *.googletagmanager.com *.youtube.com *.youtube-nocookie.com *.facebook.com; frame-ancestors 'self'; img-src 'self' *.bigbadtoystore.com *.rackcdn.com *.paypal.com https://*.paypalobjects.com *.bing.com *.cloudfront.net *.facebook.com *.google.com *.google-analytics.com *.doubleclick.net *.googletagmanager.com *.cookielaw.org *.googleadservices.com *.reddit.com *.googlesyndication.com *.ytimg.com *.youtube.com *.gstatic.com *.w3.org data:; media-src 'self' *.bigbadtoystore.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.bigbadtoystore.com *.bing.com *.google.com *.rackcdn.com *.paypal.com https://*.paypalobjects.com *.braintreegateway.com *.jsdelivr.net *.google-analytics.com *.googletagmanager.com *.facebook.com *.facebook.net *.googleadservices.com *.doubleclick.net *.msecnd.net *.helpscout.net *.cookielaw.org *.onetrust.com device.maxmind.com clarity.ms *.reddit.com *.redditstatic.com *.youtube.com *.googlesyndication.com *.cloudflareinsights.com *.hotjar.com *.tiktok.com https://*.amplitude.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com *.jsdelivr.net *.googletagmanager.com https://fonts.cdnfonts.com; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=kJcnNYyoy10hoDMQFIYI5mHkfpb05pGg72xUChUdpOI-1766643508-1.0.1.1-LPjhlGtfVIz6f7kbE.o.vmcUsI9eZwVTLgQTZeOJSFP9GKzpokWYeazcuCRShp4SpJfV_4dGssb.yt1F32GYY184xRWz_HXZWt_r7yyq3SsMQfY5niETus2T9yIFuGv5j3GikbmDQeLQIQoqdbTSO49obFzc32tJepahRWByZn_3..4I28vaVL098eOOC7jEH7ME.KRZnHZtCVC_BkHMnQ; report-to cf-kdosqwhlkndnvabk

connect-src 'self' *.google.com google.com *.bing.com https://*.paypal.com https://*.paypalobjects.com *.braintree-api.com *.braintreegateway.com *.google-analytics.com *.doubleclick.net *.visualstudio.com *.cloudfront.net *.helpscout.net *.cookielaw.org *.googleadservices.com *.mmapiws.com *.onetrust.com *.youtube.com *.googlesyndication.com *.redditstatic.com *.reddit.com *.googletagmanager.com *.tiktok.com wss://ws.hotjar.com *.hotjar.io *.facebook.com https://*.amplitude.com; default-src 'self'; font-src 'self' https://fonts.gstatic.com https://fonts.cdnfonts.com data: https://*.paypalobjects.com; frame-src 'self' *.paypal.com *.braintreegateway.com *.doubleclick.net *.googleadservices.com *.googlesyndication.com *.googletagmanager.com *.youtube.com *.youtube-nocookie.com *.facebook.com; frame-ancestors 'self'; img-src 'self' *.bigbadtoystore.com *.rackcdn.com *.paypal.com https://*.paypalobjects.com *.bing.com *.cloudfront.net *.facebook.com *.google.com *.google-analytics.com *.doubleclick.net *.googletagmanager.com *.cookielaw.org *.googleadservices.com *.reddit.com *.googlesyndication.com *.ytimg.com *.youtube.com *.gstatic.com *.w3.org data:; media-src 'self' *.bigbadtoystore.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.bigbadtoystore.com *.bing.com *.google.com *.rackcdn.com *.paypal.com https://*.paypalobjects.com *.braintreegateway.com *.jsdelivr.net *.google-analytics.com *.googletagmanager.com *.facebook.com *.facebook.net *.googleadservices.com *.doubleclick.net *.msecnd.net *.helpscout.net *.cookielaw.org *.onetrust.com device.maxmind.com clarity.ms *.reddit.com *.redditstatic.com *.youtube.com *.googlesyndication.com *.cloudflareinsights.com *.hotjar.com *.tiktok.com https://*.amplitude.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com *.jsdelivr.net *.googletagmanager.com https://fonts.cdnfonts.com; report-uri https://csp-reporting.cloudflare.com/cdn-cgi/script_monitor/report?m=y8dCmS8DtN34oUd1dxBTjModLcbTGaZ0DS5TMbgSu_k-1766643519-1.0.1.1-wHkl_I051x._lVzudLLMZM9haLTHqFoO_IyoCJMhxJQGwJB.jVd9unS2kQtPHxdoXJlkmWIjAoQTIJVUeOJnUZW_eyPIX23Iry_Gr1fv031WAlyNltq3oChhwWgtCUSHGqtr5mrjOoRXtBNfZiKvLZXe9jgdPh3zOTAOuFgQp3wprPggh40maThejCRvEXpJQwWSxw_7_o55ZhyD0ueJTg; report-to cf-grzdennqhjghboyp

default-src 'none'; script-src 'nonce-1InsIyplXDoXLdf8' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; sandbox allow-same-origin allow-scripts allow-popups allow-forms

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

Tracking domain: static.cloudflareinsights.com

static.cloudflareinsights.com

✅ Low Risk - https://www.bigbadtoystore.com/Product/VariationDetails/347188?srsltid=AfmBOoodOuTLw9Yp9oBX9FQuZ6LTQxtdsn7QHoWtFoJLWMwIWCJAEkrT

Requests	IP Address	Location	AS Autonomous System
2	104.18.23.251	United States	AS13335CLOUDFLARENET
2	104.18.94.41	United States	AS13335CLOUDFLARENET
2	104.18.95.41	United States	AS13335CLOUDFLARENET
2	104.16.79.73	United States	AS13335CLOUDFLARENET
2	104.18.22.251	United States	AS13335CLOUDFLARENET
12	5	-	-

Security Scan Report: www.bigbadtoystore.com

Summary

AI Security Verdict

Details

Bot Protection Detected

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Content Similarity HashesFor malware variant detection

Image Hashes

Perceptual Hashes

Other Hashes

Scan History