Verdict
portaldecompraspublicas.com.br appears legitimate.
Our checks found nothing pointing to fraud. Ordinary care still applies when you pay or sign in.
| What this site appears to be | Portuguese-language govtech marketplace for public procurement (Portal de Compras Públicas) offering a platform for public buyers and suppliers to publish and participate in tender processes. The page includes certifications, contact phone numbers, support info, articles, privacy and cookie policy links, and organizational address and registration (CNPJ). |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 12 years oldRegistered history | Clear |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by Amazon RSA 2048 M04 | Noted |
The page as captured
No screenshot is retained for this report.
Key findings
- Automated classification: Not Scam.
- Domain age: more than 10 years (registration continuity).
- No flags from the reputation services TrustSniffer consulted at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Overview
This Portuguese-language website presents itself as a Brazilian govtech marketplace for public procurement, connecting public-sector buyers, suppliers, consultants, and society through searchable tender processes, guided participation, account services, and procurement-management support.
Scam/Impersonation Risk
No contradictions were observed: the reviewed material contains no phishing, impersonation, blacklist, or malicious-reputation indicators. The homepage describes a coherent public-procurement business model, including tender publication and participation, buyer and supplier workflows, integration with the PNCP, and adherence claims relating to Lei 14.133/21. Behavioral review identified two suspicious inline scripts and substantial external posting activity, but also found no hidden forms, no sensitive external password forms, no wallet activity, no cloaking, and no non-whitelisted external requests; these limited technical anomalies do not establish deceptive intent and are outweighed by the broader clean signal set.
- The homepage identifies the service as “O Maior Marketplace de Licitações do Brasil” and provides buyer, supplier, process-search, support, and account-service functions.
- The domain registration record shows creation on 2014-11-17 and an age of 11.75 years.
- External reputation checks recorded `vt_malicious: 0`, `vt_suspicious: 0`, `gsb_malicious: false`, and `external_blacklist: false`; the site is listed within the global top one million by traffic, at rank 51014.
- Behavioral inspection recorded `suspicious_inline_scripts: 2`, `hidden_forms_detected: false`, `password_external_forms: 0`, `wallet_drainer_runs: 0`, and `cloaking_classification: "none"`.
Regulatory Verification Notes
The site provides substantive organizational and policy disclosures, including an address, CNPJ information, contact channels, support information, privacy and cookie policies, and stated ISO 9001, ISO 27001, ISO 27701, and ISO 20000-1 certifications. It also states that it is integrated with the PNCP and associated with ATCG. These are positive transparency and operating-model signals, while the reviewed evidence does not independently verify the underlying certifications, the CNPJ relationship, or any separate regulatory authorization; licensing status is therefore a verification matter rather than an indication of deception. The registration record names Ecustomize Consultoria em software SA, but the available evidence does not independently connect that legal entity to the public-facing operator, so the site should be described as apparently legitimate rather than identity-proven.
- The homepage displays the stated ISO certifications, PNCP integration, ATCG association, support availability, and organizational contact information.
- The reviewed site content includes privacy and cookie-policy links and identifies a CNPJ and organizational address.
- The site's transport encryption uses a DV certificate issued by Amazon RSA 2048 M04, valid through 2027-02-20.
- The registration record lists Ecustomize Consultoria em software SA as the owner.
What to Verify Next
Before credential or payment interactions, an independent check should confirm that the named operating entity, CNPJ, published address, and certification claims correspond to the official business records and certification issuers. Where a procurement activity requires a regulated authorization or formal platform registration, the relevant Brazilian registry or contracting authority should be consulted directly. Standard merchant and platform checks should also confirm applicable terms, dispute handling, refunds or service credits, and payment-protection arrangements; official support channels should be confirmed through an independent route.
- The reviewed homepage provides account sign-up and login callouts but did not present a sensitive login form in the captured page.
- The site exposes a tender-search function, allowing procurement information to be examined before account activity.
- The reviewed content includes policy links, support references, telephone contact numbers, and organizational registration details that can be compared against independent records.
Summary Verdict
Available evidence is consistent with an established, apparently legitimate public-procurement platform and supports a high-trust, low-risk posture for ordinary use. The classification is strong, but the real-world operator identity remains independently unverified; that distinction prevents the legitimacy assessment from being treated as definitive proof of ownership.
Infrastructure Integrity
The website is protected by AWS CDN/WAF infrastructure, with observed edge addresses associated with AS16509; the observed resolution contained no origin candidates. This is a meaningful exposure-mitigation measure, but protective hosting infrastructure is not, by itself, proof of operator legitimacy.
- Hosted through Amazon.com, Inc. on AS16509, with observed edge IPs 18.228.89.206, 54.232.224.110, and 56.126.177.18.
- Infrastructure resolution identified AWS CDN/WAF protection and recorded `likely_origin_ip_count: 0`.
Closing Assessment
Normal browsing and routine platform use are proportionate to the available risk assessment, while independent entity, authorization, policy, and payment-protection checks should be completed before material credential or payment commitments.
Written analysis generated 2026-08-13 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
No rule findings contributed to this verdict.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of portaldecompraspublicas.com.br.
- The request stayed on portaldecompraspublicas.com.br. It was not redirected to another domain. Clear
- DNS for this domain is served by awsdns-28.org, across 4 name servers. Noted
- The registration is paid up to 2027-11-17. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 54.20.132.71 |
| Name servers | ns-1249.awsdns-28.org, ns-2046.awsdns-63.co.uk, ns-751.awsdns-29.net, ns-91.awsdns-11.com |
| SSL issuer | Amazon RSA 2048 M04 |
| SSL expiry | 2027-02-20 |
| Domain age | 11.75 years (continuous registration) |
| Domain expiry | 2027-11-17 |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about portaldecompraspublicas.com.br at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.