Sift
Sift is a wappalyzer technology that ScanMalware.com has fingerprinted across 295 public website scans. Each of those scans is a real headless-browser visit, so the data on this page reflects how Sift is actually deployed on the live web — including on compromised, phishing and malware-hosting sites, not just legitimate ones.
On sites where Sift appears, the technologies most often detected alongside it are HSTS, Google Sign-in and React. That co-occurrence pattern is a useful fingerprint of the stack Sift typically ships with, and a starting point for spotting deployments that look unusual.
Commonly deployed alongside Sift
Of the 295 public scans where Sift was detected, these are the technologies most often present on the same site. The share is the percentage of Sift sites that also ran each one.
| Technology | Category | Share of Sift sites |
|---|---|---|
| HSTS | wappalyzer | 77.29% |
| Google Sign-in | wappalyzer | 64.07% |
| React | wappalyzer | 61.36% |
| Kasada | wappalyzer | 57.97% |
| Contentful | wappalyzer | 57.63% |
| Vercel | wappalyzer | 49.83% |
| Google Tag Manager | wappalyzer | 32.2% |
| Open-Graph-Protocol | miscellaneous | 28.47% |
| Google Analytics | wappalyzer | 22.03% |
| Google-Analytics | miscellaneous | 20% |
| X-UA-Compatible | miscellaneous | 15.93% |
| Cloudflare | wappalyzer | 15.59% |
| Facebook Pixel | wappalyzer | 13.22% |
| Cloudflare Bot Management | wappalyzer | 12.88% |
How ScanMalware detects Sift
Sift is detected by analysing the response headers, HTML markup, JavaScript runtime and asset URLs captured when ScanMalware loads the site in a real headless browser.
From any scan you can pivot into related signals — JARM TLS fingerprints, ASN ownership and BGP routing, certificate history, JavaScript analysis and the overall security verdict — to understand not just that Sift is present, but how it is being used. Open the full search interface for Sift →
Recent public scans featuring Sift
A rolling sample of recent public scans where Sift was detected. Listing a site here is not a safety judgement — open a scan to see its full verdict.
| Site | Scanned |
|---|---|
| 404: NOT_FOUND https://fulfillment-ui.xpanse.com/api/afs/event | 2026-11-08 |
| 404: NOT_FOUND https://shopee-br-aq.vercel.app/ | 2026-11-06 |
| 404: NOT_FOUND https://ventraip-domains.vercel.app/ | 2026-11-06 |
| 404: NOT_FOUND https://relay-l660.vercel.app/ | 2026-11-06 |
| AZ Alkmaar vs Juventus FC Tickets - Hellotickets https://www.hellotickets.nl/az-alkmaar-vs-juventus-fc-tickets/m-11930 | 2026-11-05 |
| 404: NOT_FOUND https://redirect-sol-finder-c4384g.vercel.app/ | 2026-11-05 |
| Kickstarter https://kickstarter.com | 2026-11-05 |
| Team protection | Netlify https://skill-practice-hub-eiu.netlify.app/index.html | 2026-11-05 |
Frequently asked questions about Sift
- Does using Sift mean a website is unsafe?
- No. Sift is a stack component, not a verdict. ScanMalware scores the whole page — its scripts, redirects, certificates, threat-intelligence matches and behaviour — so a site using Sift can be perfectly safe or actively malicious.
- How many sites using Sift has ScanMalware scanned?
- Sift has been detected in 295 public scans on ScanMalware.com. Each scan is a real headless-browser visit, and the figure updates as new URLs are submitted.
- What technologies are commonly used with Sift?
- Across scanned sites, Sift is most often seen alongside HSTS, Google Sign-in and React. The full co-occurrence breakdown is listed on this page.
Browse all profiled technologies on the technology index, or scan a URL to see its full stack.