Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
peterson-legislation-civilization-assistance.trycloudflare.com shows high-risk / scam indicators.
| What this site appears to be | Raw directory index exposing executable files (rat.exe, stealer.exe, etc.). Likely malicious hosting of malware; avoid accessing/downloading files. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a bare, auto-generated web-server directory index, titled "Directory listing for /", published on a temporary tunnel-style hostname. It has no branding, navigation, product, pricing or business narrative. It lists a CGI folder and four files: an executable named for a remote-access trojan, an executable named for a credential stealer, a Roblox-themed executable, and a setup script. It has no apparent commercial purpose. The evidence indicates it functions as a staging point for distributing malicious binaries.
Scam/Impersonation Risk
Confirmed contradictions are present, and the posture is explicitly cautionary. Multiple independent threat-intelligence sources currently flag the host as malicious or suspicious, including two top-tier security engines. The host is blacklisted on that basis. The homepage content corroborates the external detections. The only items the directory exposes are executables whose filenames describe remote-access and credential-theft tooling, plus a game-themed executable that is a typical lure for younger audiences. The page's own behaviour shows no login form, hidden form, wallet prompt or external data posting. The danger is therefore not credential phishing through a web form but direct delivery of hostile payloads to anyone who downloads and runs these files. A content analyzer also noted a naming resemblance to a well-known infrastructure brand. This is a weak lookalike signal, not a confirmed impersonation, and it is unsupported by any branded content on the page. No conflicting legal identities appear, because the site presents no identity at all. Evidence:
- Homepage: the directory index lists a CGI folder and four files, including the executables "rat.exe", "stealer.exe" and "roblox.exe" and a setup script.
- Homepage: it contains only about a hundred characters of text, with no description, product, terms, or contact route.
- External reputation: several independent engines report the host as malicious and others as suspicious, which drives the blacklisting.
- Browser sandbox: three consecutive runs returned stable pages with no forms, external network calls or wallet interactions, which isolates the risk to file delivery.
Regulatory Verification Notes
The site publishes no company name, licence, registration number, privacy policy, terms or support channel. These absences are expected for a raw file index and are not what drives the assessment. Operator identity is unverified, and ownership cannot be tied to any real-world entity. No third-party broker or regulator record was matched, and no licensing is claimed. The page presents no regulated activity to assess. The transport layer offers no assurance about the operator, because a domain-validated certificate only confirms control of the hostname. Evidence:
- Homepage: no legal, about, or compliance pages exist and no licensing claims are made.
- Site transport encryption: TLS certificate issued by WE1 (domain-validated), valid to 2027-01-03.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
What to Verify Next
No verification step can make the exposed files safe to run. Any party that has already downloaded or executed one of the listed files should treat the device as potentially compromised. That means isolating it, running a full scan with an up-to-date endpoint security product, and rotating passwords and session tokens from a clean device. Security teams should check proxy, DNS and endpoint logs for any contact with this hostname. They should also report the hostname to the tunnel provider's abuse channel and block it at the web gateway. Anyone who received the link should be asked how and from whom it arrived, since the delivery message is the likeliest path to the attacker. Evidence:
- Homepage: the listed executables are the objects most relevant to endpoint triage and hash-based hunting.
- Hosting: the hostname sits on a shared tunnel service, so abuse reporting to the service provider is the practical takedown route.
- External reputation: current malicious and suspicious detections on the host support immediate blocking.
Summary Verdict
The site carries a critical, high-risk posture. The evidence indicates deliberate hosting of malware-style tooling, not an ordinary website with isolated flaws. Its content, its external threat detections and the absence of any legitimate commercial function converge on the same conclusion.
Infrastructure Integrity
The site is served through Cloudflare's CDN/WAF, and the hostname is a temporary tunnel address. All observed addresses are edge servers, and the origin server is not observable. Protective infrastructure is a mitigating factor only. It says nothing about the intent of the content, and it cannot offset the external threat detections.
Closing Assessment
The site should not be used for any purpose beyond analysis. Nothing from it should be downloaded or executed, and no credentials or payment details should ever be associated with it. It should be blocked at network and endpoint controls.
Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, page content, several checks together.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Page content
- The review of the page content rated it high risk.Page content
rule:PAGE_RISK_HIGH - The page content shows three or more warning signs that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_STRONG - The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
03 Several checks together
- Several independent checks pointed to risk at the same time.Several checks together
rule:HYB_MULTIPLE_MODULES_HIGH_RISK
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of peterson-legislation-civilization-assistance.trycloudflare.com.
- The request stayed on peterson-legislation-civilization-assistance.trycloudflare.com. It was not redirected to another domain. Clear
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | Not available |
| Country | Not available |
| Server IP | 2606:4700::6810:e784 |
| Name servers | Not available |
| CDN / edge network | Lookup incomplete |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-03 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not available |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about peterson-legislation-civilization-assistance.trycloudflare.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.