Find hidden revenue, traffic, technical and operational risks in an online business before you make an offer.
See what the listing doesn’t tell you.
Paste the URL
No account, no card.
Read the report
21 of 35 checks, each one priced.
Ask the seller
Read-only. Only what they grant.
See the real numbers
Revenue checked against their own records.
F(x) reads the seller’s payment and analytics records for all three, then restates the monthly revenue without them.
Stripe shows 218 of 531 paying customers on a 50%-off coupon that runs for twelve months. Once it ends the real monthly revenue is $8,900, not the $11,280 the listing claims.
“Pricing is stable across the customer base.”
seller’s listing, section 2
Google Analytics shows 61.4% of visits came from paid ads over twelve months. The ad account is not included in the sale, so those visitors leave with the seller unless you keep paying $4,100 a month.
“Traffic is overwhelmingly organic.”
seller’s listing, section 4
500 paying customers, and only 320 people visited in the best of the last three months. The other 180 are billed every month and have not opened the product.
“Engagement is strong and growing.”
seller’s listing, section 1
That was three of 35 checks. The rest are grouped below, with what each group reads and what one finding takes off the price.
Free groups need only the web address; Seller data groups need the seller’s read-only access, and are the paid half.
What the site hands to anyone who asks for it, including things nobody meant to publish.
64%of the credentials found leaked in 2022 were still live when they were re-checked in January 2026. A key does not stop working because the site was rebuilt.
What the application returns to a request carrying no session at all.
170+live apps built on Lovable had a customer database that anyone at all could read, change or delete. The platform shipped the setting that prevents it switched off.
The protections a browser relies on the site to set, and whether this one sets them.
79%of the world’s top million websites are missing the one setting that stops a stranger rewriting the page inside a customer’s browser.
What the build pulls in from strangers, and what was left running and forgotten.
19.7%of the ready-made parts an AI assistant recommends do not exist. Attackers register the made-up names and wait for the next person to install one.
The registrations the business runs on, who holds them, and when they lapse. None of it appears in a listing, and all of it is readable without asking the seller for anything.
35days is all there is once a registration is deleted - a 30-day redemption window, then five days pending deletion, and then anyone at all may register the name.
Whether the reported revenue matches the ledger behind it - the subscription ledger for a SaaS, the order history for a store.
AdjustmentMeasured at scan time. The gap between reported and committed revenue comes out of the seller’s own subscription history, so there is no figure to print until there is a seller.
3%of the 200 Flippa listings we sampled showed revenue Flippa itself had verified. The other 194 are asking you to take the screenshot on trust.
Whether the business can be run by someone who did not build it.
AdjustmentCounted from the repository the seller granted, and it changes the structure of the deal instead of the figure: a discount cannot hold a founder in place, and a holdback can.
74%of popular open-source projects stop dead if one or two people walk away. Those projects had other contributors; a codebase one founder wrote alone has none.
No write, refund or admin scope is ever requested. The Stripe, Shopify and Google Analytics connectors were verified by the platforms themselves.
I’ve been building this project for about a year, actively engaging with small scale buyers and noting their pain-points with acquisitions. What started as an in-house GitHub scanner has now become a preventive tool that helps secure successful and accurately priced deals for clients.
The seller’s token is encrypted, read once to price the findings, and discarded when the scan finishes - whether it succeeded or not. The raw evidence behind a finding is deleted after 30 days, which is what the privacy policy commits to. Your report and its findings stay.
Each tool is granted separately, on a page that names exactly what it reads before anything is connected. A seller can refuse any of them and say why, and your report prints that answer in their own words.