Is collectible-porsche.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

collectible-porsche.com is a newly registered website whose name suggests a marketplace or catalogue for collectible Porsche vehicles or memorabilia. When automated analysis tried to load its homepage, the visitor was stopped at a security interstitial headed "Suspected Phishing", so the page's real content was not obtained. The apparent purpose is therefore unconfirmed. What the site is actually used for cannot be read from its own pages and has to be inferred from reputation and registration signals.

Scam/Impersonation Risk

Contradictory signals are present, and they are serious. Several major security vendors currently classify the domain as malicious, and a further group rate it suspicious. This amounts to a confirmed blacklisting from external reputation sources. The homepage did not load. The visitor was served an intermediary warning page, titled as a suspected-phishing notice, instead of any marketplace content. The domain also matches a known-phishing pattern in the historical record. No competing legal-entity names were found, and no direct brand impersonation was established, so the risk rests on reputation and provenance rather than on identity conflict. The sandbox run does offer some mitigation. Outbound requests and form submissions went only to recognised destinations. No wallet-connection prompts, clipboard tampering, hidden forms or credential posts to third parties were seen. These behavioural results do not outweigh the independent threat detections. Name-based enthusiast-brand domains this young are a common vehicle for deceptive sales and credential harvesting, and the warning page is consistent with that. Evidence:

• Homepage: access was gated by a security challenge, and the page title read "Suspected Phishing".
• Reputation sources: 8 malicious and 2 suspicious verdicts, including three tier-one security vendors.
• Domain registration: created 2026-08-28 (~0.16 years old), about two months before analysis.
• Web archive: 1 snapshot, first and last seen 2026-09-06, so there is no established history.
• Homepage behaviour: 21 external XHR requests and 9 external POSTs were observed, none to non-whitelisted destinations. No wallet, clipboard or hidden-form activity was detected.

Regulatory Verification Notes

The content that could be reviewed contains no licensing, registration or corporate-identity disclosure. No independent regulator or broker-reputation record matched the domain, so no positive regulatory standing can be attributed to it. This is a verification gap, not proof of wrongdoing by itself. Here it sits alongside confirmed threat detections, and the site shows ownership opacity. The registrar is NICENIC International Group Co., Limited, which does not identify the operator. A site that sells or lists high-value collectible vehicles would be expected to disclose a legal entity, a physical address and its dealer or sales credentials. None of these could be seen. The operator's real-world identity is unverified, and nothing in the evidence supports treating the site as an established merchant. Evidence:

• Registration: domain registered through NICENIC International Group Co., Limited, created 2026-08-28 and expiring 2027-08-28.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport security: TLS certificate issued by WE1 (domain-validated only), valid to 2026-11-26, with about 31 days remaining.
• Third-party broker database: no matching record found.

What to Verify Next

Any contact with this domain should begin with independent verification. This applies even for read-only browsing. A claimed vehicle seller's legal entity, dealer licence and address should be checked against the relevant national business or motor-dealer register. They should not be taken from the site itself. Listed vehicles or collectibles should be cross-checked with the manufacturer's authorised channels and recognised auction houses. The vehicle identification numbers and any provenance documents should be confirmed with them as well. The official support and contact channels should be established offline. The domain's status with major browser and security-vendor warning lists should be rechecked after a fresh scan. Any change in reputation findings should be reviewed before the domain is reconsidered. Evidence:

• Domain age: the domain is about two months old, with no verifiable operating history.
• Reputation: current detections show the domain is flagged by several independent security vendors.
• Homepage: any product or seller claims remain unconfirmed because the live content was gated.

Summary Verdict

The site presents a high-risk, critically low trust posture. A very recent registration, threat-intelligence detections and a phishing-labelled warning page converge. The technical hygiene signals are ordinary and do not offset them. The operator's identity is unverified, and the evidence does not support treating the site as legitimate.

Infrastructure Integrity

The domain resolves entirely to edge servers operated by a major CDN and WAF provider in the United States, under AS13335. The origin server was not observable. A valid TLS certificate and bot-challenge protection are present, and the edge infrastructure is a mitigating factor only. These protections are available to any customer, legitimate or not, and they cannot offset the external detections. The origin's concealment also means the actual hosting cannot be checked independently, and content could be swapped quickly. The young domain has few DNS subdomains, which is an unconfirmed heuristic and not a finding in its own right.

Closing Assessment

The site should be treated as unsafe for any login, credential entry, payment or other financial interaction until the detections are cleared and an independent identity check succeeds. Passive, read-only viewing from an isolated environment is the only proportionate use. No files should be downloaded from it.