Is pnf-actifs.com a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a newly established site whose homepage is titled "Assistance | Portailpro.gouv". It presents itself as a support page for a government professional portal, under a domain name (pnf-actifs.com) that is unrelated to any official government address. The page is a single-page front end that makes background calls to external services. Its apparent purpose is to look like an official assistance or portal service, and the stated purpose has not been independently confirmed.

Scam/Impersonation Risk

Confirmed contradictory signals are present. Several major security vendors currently flag the domain as malicious, and the combined detections are strong enough to count as a confirmed blacklist listing. The domain is also recorded as a known phishing source. The homepage title borrows the naming of an official government portal ("portailpro.gouv") on a commercial .com domain with no demonstrated link to that service. This combination of government-style branding, a freshly registered domain, and active third-party malicious detections is a classic pattern for credential-harvesting or impersonation pages. No conflicting legal-entity names were found, so the concern is reputational and behavioural, not an identity contradiction. In the behavioural sandbox, the homepage sent most of its network traffic to external destinations, including several background requests and external submissions. The sandbox did not observe wallet interaction, clipboard manipulation, hidden forms, or content cloaking, and none of the external destinations were unrecognised. The sandbox findings do not offset the active threat detections. Evidence:

• Homepage: the page title mimics an official government professional portal, while the domain is an unrelated commercial one.
• Domain registration: the domain was registered on 2026-07-31 (~0.24 years old, about 87 days), well inside the window typical of short-lived abuse campaigns.
• Web archive: only 3 snapshots, spanning 2026-08-10 to 2026-09-22 (1 year tracked), so there is no established history to counterbalance the detections.
• Reputation: 11 malicious and 2 suspicious verdicts from 18 effective engine verdicts, including two tier-one security vendors.

Regulatory Verification Notes

The site gives no verifiable basis for any government or regulated affiliation. Nothing in the evidence connects the domain to the authority whose portal naming it uses, and the operator's real-world identity remains unverified. The registration record is privacy-masked, which is an administrative limitation and not by itself an indicator of wrongdoing. No third-party broker or regulatory-database match exists for this domain, so there is no external reputational context to weigh in either direction. Claims of official status must therefore be treated as unsubstantiated. The valid encryption certificate and a complete registration record establish only technical hygiene. They do not establish that the site is legitimate. Evidence:

• Hosting infrastructure: served from AS40509 (Fly.io, Inc., US), a commodity hosting platform with no link to a government network.
• Transport encryption: the TLS certificate is issued by YE1 at DV level (domain control only, no organisation vetting), valid to 2027-01-06.
• Registration: registrar is PDR Ltd. d/b/a PublicDomainRegistry.com, with owner and organisation masked under GDPR privacy; the registration expires 2027-07-31.

What to Verify Next

Anyone who received a link to this domain should not rely on it to judge authenticity. Instead, they should reach the genuine government professional portal by typing its officially published address into the browser or using a bookmark saved earlier. They should then check whether the portal operator lists the domain pnf-actifs.com as an official service, and confirm official support channels through an independent, offline route. If a message, SMS, or email led to this site, its sender should be treated as unverified, and the message should be reported to the genuine portal operator and the relevant national cybercrime or phishing-reporting service. Organisations that find traffic to this domain in their logs should treat it as a potential phishing indicator and check whether any user entered credentials. Evidence:

• Homepage: the government-style title is the specific claim that must be checked against the official portal.
• Domain registration: the domain is under three months old, so an official affiliation would be unlikely to have been established.
• Reputation: the active malicious detections call for independent confirmation through official channels, not through anything on this site.

Summary Verdict

The overall posture is high risk, with a decisive adverse reputation. Active third-party malicious detections, a very recent domain, and government-portal branding without any demonstrated link to that authority converge into a consistent picture of probable impersonation or phishing infrastructure. The site's technical hygiene is adequate but carries no weight against these signals.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF, and all observed addresses are edge nodes on the Fly.io network, so the origin server was not observable and the hosting could not be verified independently. Protection of this kind is a mitigating factor only. It does not offset the active threat detections, and edge-only visibility can also conceal rapid content changes behind the same address.

Closing Assessment

The site should not be used for login, credential entry, or any financial or personal-data interaction, and at most it should be viewed passively. Any credentials already submitted should be changed immediately, and the incident should be reported to the genuine portal operator and relevant authorities.