Is Vercel a scam? TrustSniffer's high-risk assessment of arc-portal-lime.vercel.app: 21/100

Overview

ARC Portal is a single-page web application served from a free subdomain of a major application-hosting platform rather than from an independently registered domain. It presents a minimal landing page titled "ARC Portal" with only a short passage of text. It states no clear product, service, or operator, so its apparent purpose is a gateway or portal whose business model cannot be determined from the page.

Scam/Impersonation Risk

The site carries an elevated risk profile, driven by contradictory external signals. Multiple threat-intelligence sources currently blacklist the host: two security engines classify it as malicious and a third as suspicious. This is a confirmed adverse reputational finding, not an inference. The hostname is also a near-lookalike of the hosting platform's own domain. That is an inherent trait of free platform subdomains, but it lets the name pass casually as platform-affiliated, and it fits a pattern in which disposable subdomains are used to stage portal-style lures. Behavioral testing found no wallet-connection prompts, clipboard manipulation, hidden or external password forms, or content cloaking. No conflicting legal identities and no brand impersonation were found on the page. Because the page offers almost no content to inspect, these clean behavioral results do not offset the blacklist. The page's observed outbound traffic is also noteworthy: it makes a substantial number of background requests and form-style submissions to third-party destinations. All of them went to recognized services, but the volume is high for a page with so little visible content. A large number of abuse reports exist against one of the platform's shared addresses. They concern the provider's shared infrastructure, not this site specifically, so they are discounted and are not treated as evidence against it. Evidence:

• Homepage reputation lookups: two engines rate the host malicious and one suspicious, and an additional external blacklist listing is active.
• Homepage behavioral sandbox: three of three runs loaded successfully, with no wallet prompts, hidden forms, external password forms, or cloaking. Fifteen third-party background requests and nine third-party submissions were observed, all to recognized destinations.
• Hosting-platform address reputation: 88 abuse reports are attached to a shared platform address, classified as shared-infrastructure noise and discounted.

Regulatory Verification Notes

The homepage is the only page captured. Its short text gives no legal entity name, licence or registration reference, terms, privacy policy, or contact route. This is a content gap on the site itself. For a page that presents itself as a "portal", it leaves visitors with nothing that ties the service to an accountable operator. Because the site runs on a platform subdomain, any registration or age signals reflect the host platform, not the operator of this site, so no independent history for ARC Portal can be established. No third-party broker or regulatory-database match exists for the name, so there is no external reputational context beyond the threat-intelligence listings. The sole positive technical finding is a currently valid domain-validated certificate. It confirms only that the connection is encrypted, not who operates the site. Evidence:

• Homepage content: roughly 700 characters of text under the title "ARC Portal", with no company name, licence number, or policy links.
• Transport encryption: TLS certificate issued by WR1 (DV), valid to 2026-11-27, with 29 days remaining.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

Any use of the site should wait until the operator is independently identified, ideally through an offline or out-of-band route such as the organization that sent the link. The destination should be confirmed as legitimate through that route, and the official support or contact channels should be established independently. If the site is claimed to belong to a regulated business, its licence should be checked directly with the relevant registry. Anyone who has already entered credentials or payment details should change those credentials and monitor the affected accounts. Evidence:

• Homepage: no operator identity or licence reference is present to check against a registry.
• Reputation findings: the active blacklist listings call for confirmation from a source independent of the site.
• Current certificate expiry is close, so any later re-check should also confirm the certificate has been renewed.

Summary Verdict

The overall posture is cautionary and security-forward. Confirmed blacklist listings are decisive, and the site's minimal content and lack of any identifiable operator leave nothing that could offset them. The clean behavioral results and valid encryption are real but minor mitigating factors. They do not support treating the site as trustworthy.

Infrastructure Integrity

The site sits behind the hosting platform's CDN/WAF layer on Amazon-operated infrastructure, and all observed addresses are shared edge servers. The origin server is not observable, so hosting cannot be verified independently and the content behind the edge could be swapped quickly. This infrastructure is a mitigating factor only. It does not offset the reputation risk.

Closing Assessment

Read-only viewing is the most that is appropriate at this point. Logging in, entering credentials, connecting accounts, or making any payment or financial transfer should be avoided until the site is cleared of its threat listings and its operator is independently verified.

Signals weighed against the site

• AbuseIPDB: 88 reports on hosting IP 216.198.79.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.