Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
saturnholders.app shows high-risk / scam indicators.
| What this site appears to be | A landing page for a 'Pre-Trial Claims Portal' that claims to deliver official pre-trial claim notices under New York law on behalf of Sony Music Entertainment. It gives no verifiable court, case number, or licensed-counsel identity. It sets a response window, says notices are reachable only via private links, and references an appeal that must be made through an 'account', with truncated and garbled text. The page itself requests no credentials or payment, but the legal-threat framing and unverifiable identity make it a high-risk notice-scam pattern. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 6 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 26 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20262 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
The website presents itself as a "Pre-Trial Claims Portal" and "Official Notice Delivery Service" for the State of New York. It says it delivers pre-trial claim notices on behalf of a rights holder, which it names as Sony Music Entertainment. A visitor sees a short description of how delivery works: a claimant's representative registers a claim, and a notification message is sent to the respondent's published contact addresses. The respondent then opens a private link to read the full notice and must record a response within a fixed window before the matter is "referred for court processing". The apparent purpose is to push recipients of a legal-threat message into an account-based appeal route. This is a recognised notice-scam pattern.
Scam/Impersonation Risk
Contradictory signals are present and decisive. The domain is blacklisted: two major security vendors currently flag it as malicious, and external reputation sources corroborate the listing. This is more than a soft reputational signal. The homepage amplifies the concern. It invokes court processing, a response deadline, and a named rights holder, but gives no court, no case number, and no identifiable licensed counsel or claimant representative. The text is truncated and garbled partway through the appeal instructions. It states that notices are reachable only through private links, which means the portal's claims cannot be checked from the page itself. The page says it never asks for passwords, one-time codes, or payment, yet it tells respondents that an appeal must be filed through an "account". That is the likely point where credentials, identity data, or fees would be harvested later. This design pairs urgency and legal intimidation with a gated, unverifiable second stage. The page does not impersonate a recognised brand in an automated sense, and no conflicting legal entities were found. However, the claim of acting for a major entertainment company has no corroboration anywhere on the site. Reputation sources and content evidence converge on a high-risk notice-scam profile.
- Homepage: presents a New York pre-trial claim process with a fixed response window and threatens referral for court processing, but names no court, case reference, or licensed representative.
- Homepage: states that notices can only be opened through private links and that an appeal must go through an "account", an unverified route that could lead to later credential capture or payment demands.
- Homepage: the legal text is cut off and garbled mid-instruction, which is inconsistent with a genuine legal-notice service.
- Domain provenance: registered 2026-09-26 (about 25 days old), with only 2 archive snapshots, both from 2026 (1 year tracked). The site has no operating history that would support its claim to be an established legal-process service.
Regulatory Verification Notes
No court, bar or counsel registration, licence, or claimant authorisation is cited on the page. Nothing on the site allows a respondent to confirm that the service is a genuine legal-process mechanism, or that it has any link to the rights holder it names. That is a disclosure gap in a context where such disclosure is essential. Here the gap sits alongside confirmed threat listings, so it reinforces a cautionary reading and is not a neutral administrative omission. No third-party broker or regulatory-registry record was matched for this entity.
- Homepage: no licence, registration number, court identifier, or named legal counsel appears anywhere in the captured content.
- Registration: domain registered through NICENIC International Group Co., Limited, created 2026-09-26, expiring 2027-09-26.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
- Transport encryption: TLS certificate issued by YE1 (DV, domain validation only), valid to 2026-12-25, so it demonstrates domain control and nothing about operator identity.
What to Verify Next
Anyone who received a message pointing to this portal should not use its links. Instead, they should check whether any legal matter exists by contacting the court or the named rights holder directly, through contact details taken from the rights holder's official website or other independent sources. Anyone who holds a message of this kind should also confirm the claimed process with a licensed attorney in the relevant jurisdiction. Official court dockets and attorney registries should be searched for any case or counsel matching the page's claims. Organisations should treat the domain as hostile in security tooling until independent confirmation is obtained.
- Homepage: no case number or court is given, so no docket search is possible from the page alone.
- Homepage: the "account"-based appeal is the sole stated route for contesting a claim, with no independent channel offered.
- External reputation: multiple independent security detections stand against the domain.
Summary Verdict
The site carries an elevated, high-risk posture. Confirmed threat listings, a legal-threat narrative that cannot be verified, and a very young domain with no history converge on a notice-scam pattern. The valid encryption certificate and the absence of overt credential or payment forms on the landing page do not offset that convergence.
Infrastructure Integrity
The site sits behind a mainstream CDN and WAF provider in the United States, and all observed addresses are edge servers, so the origin host could not be seen. The provider's protections are a mitigating factor only. They do not vouch for the operator, and edge-only visibility makes it harder to verify the hosting independently and could allow content to be swapped quickly. Infrastructure quality therefore cannot offset the reputational and content risk assessed above.
Closing Assessment
Interaction should be limited to passive viewing at most. No account should be created, no credentials, personal data, or payments should be provided, and no files should be downloaded. Any message that directed a recipient here should be reported to the relevant security or fraud contact.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by external reputation, hosting and network, page content, history in the web archive.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
03 Page content
- The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The page content shows three or more warning signs that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_STRONG - The review of the page content rated it moderate risk.Page content
rule:PAGE_RISK_MED
04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of saturnholders.app.
- The request stayed on saturnholders.app. It was not redirected to another domain. Clear
- Registration is published under NICENIC INTERNATIONAL GROUP CO., LIMITED. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-09-26. Noted
- The earliest public archive of this site is from 2026-09-26. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | NICENIC INTERNATIONAL GROUP CO., LIMITED |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3031::ac43:d487 |
| Name servers | andronicus.ns.cloudflare.com, leanna.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | YE1 |
| SSL expiry | 2026-12-25 |
| Domain age | 0.07 years (continuous registration) |
| Domain expiry | 2027-09-26 |
| Archive first seen | 2026-09-26 |
| Archive snapshots | 2 |
| Reputation | VirusTotal: 6 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about saturnholders.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.