Is portail-de-signalement-et-de-suivi.vercel.app safe?
http://portail-de-signalement-et-de-suivi.vercel.app/
Checked on
How we checked
Coverage: strong · 3 of 4 applicable core capabilities
- Antivirus (59 of 93 engines answered): completed
- Google Safe Browsing: completed
- page reading · limited: did not fully complete
- page capture: completed
- domain records: completed
- web research: completed
ONCF-branded "Portail FM Gares" login portal sits on a generic Vercel subdomain and drew an isolated phishing detection
This address hosts a French-language facility-management portal titled "Portail FM Gares" that carries ONCF railway branding and presents a login form for reporting and tracking station maintenance issues. The concern is not a technical infection: the saved checks show a valid encrypted connection and no browser threat feed warning, and the hosting IP has a clean abuse record. The concern is identity and placement. The portal is served from a generic vercel.app subdomain rather than an official ONCF domain, and one antivirus family flagged it as phishing while the other 92 engines did not. Because the site's own contact and policy pages were not read in full, we could not confirm who actually operates it or whether ONCF authorised it. That combination — an official-looking credential prompt on an unverified third-party subdomain — is exactly the pattern used for credential harvesting, so the score lands in the moderate-risk band rather than Safe.
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 52/100
Moderate Risk covers scores 45–69. 2 findings pulled the score down; 3 pushed it up.
What pulled the score down
- Strong1 independent antivirus family reported an adverse result.
- MinorAn ONCF-branded credential portal is served from a generic vercel.app subdomain rather than an official ONCF domain, and the operator's identity could not be verified from the site's own pages.
What pushed the score up
- SupportsThe browser threat feed returned no threat warning for this address.
- SupportsThe saved TLS check found a valid encrypted connection.
- SupportsThe hosting IP has an abuse confidence score of 0/100 across 80 saved reports.
No points per finding are stored for this report: our analysis weighed all findings together to set the score. Each finding shows its saved severity instead (Decisive, Strong, Moderate or Minor). Community reviews never change the Safety Score.
01 · Investigation Brief
Investigation Brief
This address hosts a French-language facility-management portal titled "Portail FM Gares" that carries ONCF railway branding and presents a login form for reporting and tracking station maintenance issues. The concern is not a technical infection: the saved checks show a valid encrypted connection and no browser threat feed warning, and the hosting IP has a clean abuse record. The concern is identity and placement. The portal is served from a generic vercel.app subdomain rather than an official ONCF domain, and one antivirus family flagged it as phishing while the other 92 engines did not. Because the site's own contact and policy pages were not read in full, we could not confirm who actually operates it or whether ONCF authorised it. That combination — an official-looking credential prompt on an unverified third-party subdomain — is exactly the pattern used for credential harvesting, so the score lands in the moderate-risk band rather than Safe.
An official-looking railway portal on a non-official domain
The page presents itself as "Portail FM Gares" — a facility-management portal for railway stations — and the saved screenshot text shows ONCF branding alongside the "FACILITY MANAGEMENT GARES" heading. Independent research describes it as a French-language portal intended for reporting and tracking non-conformities or maintenance issues related to railway stations and connected building services. On its face, that is a plausible internal or partner-facing operational tool.
The placement is the problem. The portal is served from a generic vercel.app subdomain rather than an ONCF-controlled domain. A shared application-hosting subdomain is a normal way to deploy a web app, but it is also a cheap and common way to stand up a convincing credential prompt that borrows a real organisation's branding. Nothing in the reviewed evidence shows ONCF authorising this deployment, and the site's own contact and policy pages were not read in full, so the operator's identity remains unverified.
Clean infrastructure checks do not settle who is behind the login
The technical picture is mostly reassuring. The browser threat feed returned no threat warning, the saved TLS check found a valid encrypted connection, and the hosting IP carries an abuse confidence score of 0/100 across 80 saved reports. Those results mean no detections were recorded — they do not establish that the operator is legitimate or that the login is safe to use.
Against that, one antivirus family — Kaspersky — reported an adverse phishing result, while the remaining 92 engines did not. That is an isolated detection without vendor consensus, so it is not proof of a live phishing campaign. It is, however, a direct adverse signal on a page whose entire function is to collect credentials, and it aligns with the unverified-domain concern rather than contradicting it.
Why the score is 52
1 independent antivirus family reported an adverse result. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
1/ 93
detectionsFresh result
1 engine flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 1
- Suspicious
- 0
- Total
- 93
| Engine | Finding |
|---|---|
| KasperskyMalicious | phishing |
All 93 engine results
- Kaspersky - phishing - Malicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Clean
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Forcepoint ThreatSeeker - Clean
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Unrated
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
How security vendors categorise this site
- Forcepoint ThreatSeekerinformation technology
- Sophosinformation technology
Each vendor’s own label for the site, saved with the antivirus result. Labels are separate from the engine verdicts above and can disagree with each other.
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual context from the captured page
ONCF FACILITY MANAGEMENT GARES
What the captured page showed
2 observations- 01
ONCF
- 02
FACILITY MANAGEMENT GARES
What the page says about itself
What the site says about itself, quoted from the pages we read. The site wrote these words; they are not our findings.
- Page title
Portail FM Gares
- Meta description
Portail FM Gares - Signalement et suivi des non-conformités
Pages we read
- Main page/Read
03 · Investigation Story
Investigation story
What the site claims
Portail FM Gares
What we observed
The page content was captured and checked alongside 59 antivirus results.
What independent research found
1 external finding was saved and compared with the page evidence.
What remains unverified
1 of the 4 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Phishing & Impersonation
Service and business model
Login Portal
Observed behavior
Evidence behind this classification
- 01One antivirus family (Kaspersky) flagged this URL as phishing; the other 92 engines returned no adverse result, so there is no vendor consensus.
- 021 independent antivirus family reported an adverse result.
- 03The hosting IP has an abuse confidence score of 0/100 across 80 saved reports.
If this is a scam — what it means for you
What happens when a visitor types credentials into this portal
A visitor arriving at this address is shown a login form for the "Portail FM Gares" facility-management portal and is invited to sign in or request an account. Because the operator's identity was never confirmed and the site's own contact pages were not reviewed, anyone entering a work username and password here cannot verify who receives those credentials.
If this is a scam, how it works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
If the deployment is not authorised by ONCF, the credentials submitted would go to whoever controls the Vercel project rather than to the railway operator — the classic credential-harvesting outcome. The isolated phishing detection on this exact URL is consistent with that risk, though it is not conclusive on its own.
Do not enter ONCF or workplace credentials on this vercel.app address. If you need the facility-management portal, reach it through an ONCF-issued link or an internal bookmark, or confirm the correct URL with ONCF IT directly. If you have already signed in here, change that password immediately and report the address to your IT or security team so they can check whether the deployment is authorised.
Web research findings
Independent findings for portail-de-signalement-et-de-suivi.vercel.app, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
No independently sourced scam reports or credibility records were found for portail-de-signalement-et-de-suivi.vercel.app. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domainportail-de-signalement-et-de-suivi.vercel.app
- Redirects toportail-de-signalement-et-de-suivi.vercel.app
- Hosted byVercel, Inc
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
Domain & Encryption
Certificate issued for *.vercel.app.
A shared content-delivery network address answers for many sites, so it is not the site's own server and says nothing about who runs it.
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1308http://portail-de-signalement-et-de-suivi.vercel.app/
- 2206https://portail-de-signalement-et-de-suivi.vercel.app/
Server Reputation
05 · Evidence Ledger
Evidence ledger
- Antiviruscomplete
- Browser threat feedcomplete
- Page contentpartial
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
1 independent antivirus family reported an adverse result. · An ONCF-branded credential portal is served from a generic vercel.app subdomain rather than an official ONCF domain, and the operator's identity could not be verified from the site's own pages.
Operator / customer risk
unknownComplaints, withdrawals, business conduct and commercial traps.
No confirmed evidence in this dimension.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 1 of 93 engines flagged | Completed | Adverse | fresh · analysed Oct 19, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 19, 2026 |
| Page content | Page fetched · HTTP 200 | Limited | No saved finding | this scan · Oct 19, 2026 |
| Visual evidence | 2 visible observations saved with the page capture | Completed | No adverse finding | this scan · Oct 19, 2026 |
| Independent research | 1 independent finding was saved | Completed | No adverse finding | this scan · Oct 19, 2026 |
- Antivirus
- Result1 of 93 engines flagged
- CompletionCompletedFindingAdverse
- Freshnessfresh · analysed Oct 19, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 19, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionLimitedFindingNo saved finding
- Freshnessthis scan · Oct 19, 2026
- Visual evidence
- Result2 visible observations saved with the page capture
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 19, 2026
- Independent research
- Result1 independent finding was saved
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Oct 19, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is portail-de-signalement-et-de-suivi.vercel.app a scam or is it safe?
Is portail-de-signalement-et-de-suivi.vercel.app safe to use?
Has portail-de-signalement-et-de-suivi.vercel.app been flagged by antivirus engines?
Is portail-de-signalement-et-de-suivi.vercel.app on any phishing or malware blacklists?
How old is the portail-de-signalement-et-de-suivi.vercel.app domain?
Does portail-de-signalement-et-de-suivi.vercel.app have a valid SSL certificate?
Where is portail-de-signalement-et-de-suivi.vercel.app hosted?
How often is the portail-de-signalement-et-de-suivi.vercel.app report updated?
08 · Final Verdict
Final verdict
ONCF-branded "Portail FM Gares" login portal sits on a generic Vercel subdomain and drew an isolated phishing detection
This address hosts a French-language facility-management portal titled "Portail FM Gares" that carries ONCF railway branding and presents a login form for reporting and tracking station maintenance issues. The concern is not a technical infection: the saved checks show a valid encrypted connection and no browser threat feed warning, and the hosting IP has a clean abuse record. The concern is identity and placement. The portal is served from a generic vercel.app subdomain rather than an official ONCF domain, and one antivirus family flagged it as phishing while the other 92 engines did not. Because the site's own contact and policy pages were not read in full, we could not confirm who actually operates it or whether ONCF authorised it. That combination — an official-looking credential prompt on an unverified third-party subdomain — is exactly the pattern used for credential harvesting, so the score lands in the moderate-risk band rather than Safe.
09 · Community
Community
Are you the owner of portail-de-signalement-et-de-suivi.vercel.app?Verify and reply