Is securefirmportal.vercel.app safe?
http://securefirmportal.vercel.app/
Checked on
How we checked
Coverage: partial · 4 of 5 applicable core capabilities
- Antivirus · not available: did not fully complete
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records · not run: did not fully complete
- web research: completed
Fake "Secure Firm Portal" login on a free Vercel subdomain sends typed email and password to a third-party form relay
This page copies the client-portal login used by accounting firms — an "AppSuite client" card with Email Address and Password fields, plus Forgot Password and Register links — but it is served from securefirmportal.vercel.app, a free hosting subdomain, while the real portal is documented at securefirmportal.com. The form does not authenticate anyone: it posts what you type to submit-form.com, an unrelated form-collection service. No operator name, address, phone or email appears anywhere on the page, and the only outbound help link points at the genuine vendor's help centre. A published security write-up describes exactly this pattern of entering credentials on a fake login page. The score is very low because the site's single purpose is to collect working logins.
At a glance
Saved with this scan; each value is explained in the sections below.
Domain age
Not available
Certificate
Valid
Expires Jan 29, 2027 (80d)Hosting
United States (US)
Vercel, IncPopularity
Not in the Cloudflare Radar top list
Antivirus
Not available
Safe Browsing
Not flagged
Not flagged on major threat listsCommunity
No reviews yet
Checked
Nov 9, 2026
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 12/100
Dangerous covers scores 1–20. 6 findings pulled the score down; 1 pushed it up.
What pulled the score down
- ModerateThe login form's email and password fields submit to submit-form.com, a third-party form service, instead of a first-party portal authentication endpoint.
- ModerateThe Help link points to the genuine CPA Site Solutions help centre, borrowing the real vendor's support path while the login itself sits on an unrelated host.
- ModerateOne public warning on a scam-warning or security site: "You entered credentials on a fake login page"
- ModerateThe page asks the visitor to type an email address and password into a login form, with 'Forgot your Password?' and 'Not yet a member? Register here.' links beneath.
- MinorThe page presents the Secure Firm Portal login but is hosted on a free securefirmportal.vercel.app subdomain, while the vendor's own help pages give securefirmportal.com as the portal address.
- MinorNo company name, address, phone number or contact email appears on the page, and no contact email was found on the captured page.
What pushed the score up
- SupportsThe browser threat feed returned no threat warning and the saved TLS check found a valid encrypted connection.
No points per finding are stored for this report: our analysis weighed all findings together to set the score. Each finding shows its saved severity instead (Decisive, Strong, Moderate or Minor).
Lost money or shared details on securefirmportal.vercel.app? Do this now
Act quickly: the first hours matter most for a chargeback.
- Call your bank or card issuer now
Ask them to dispute the charge or open a chargeback; the sooner you act, the better your odds. Card payments can often be reversed. Bank transfers and gift cards are harder, but report them to your bank too. Crypto payments usually cannot be reversed: report the wallet address and transaction ID to the exchange you sent from.
- Change any password you entered
If you entered a password on securefirmportal.vercel.app, change it there and anywhere you reused it, and turn on two-factor authentication. Keep screenshots, order confirmations and messages as evidence.
- Report the site
Reports help get scam sites taken down faster and warn other people.
- Report the domain to its registrar
The registrar is the company that sold this domain. ICANN's lookup shows the registrar's abuse contact.
- Ignore anyone offering to recover your money
"Recovery" services or agents who contact you, or ask for a fee up front, are almost always a second scam aimed at victims. Your bank's dispute process and the official reporting services never charge a fee in advance.
Full answers about refunds and reporting are in the Safety FAQ below.
01 · Investigation Brief
Investigation Brief
This page copies the client-portal login used by accounting firms — an "AppSuite client" card with Email Address and Password fields, plus Forgot Password and Register links — but it is served from securefirmportal.vercel.app, a free hosting subdomain, while the real portal is documented at securefirmportal.com. The form does not authenticate anyone: it posts what you type to submit-form.com, an unrelated form-collection service. No operator name, address, phone or email appears anywhere on the page, and the only outbound help link points at the genuine vendor's help centre. A published security write-up describes exactly this pattern of entering credentials on a fake login page. The score is very low because the site's single purpose is to collect working logins.
Where your password actually goes
The page shows a centred login card titled "AppSuite client" with an email field, a password field and a blue Log in button, and the underlying form markup carries those same email and password inputs. Anyone who has been told to "log into the firm portal" would recognise the layout and type their real work credentials into it.
The form's submission target is submit-form.com, a generic third-party form-relay service, not any securefirmportal.com authentication endpoint. Whatever is typed into the email and password boxes is therefore delivered to an unrelated host rather than checked against a real portal account.
The supporting links reinforce the illusion: Forgot your Password? and Register here. point to same-site paths on the Vercel subdomain, and the Help link goes to the genuine CPA Site Solutions help centre. The real vendor's own documentation says the portal login lives at securefirmportal.com and that portal mail comes from portal-notification@securefirmportal.com, so a vercel.app address is not the portal.
Clean technical checks, no accountable operator
Nothing in the technical layer blocks the page: the browser threat feed returned no threat warning, the connection is encrypted with a valid certificate, and the shared Vercel hosting address carries no abuse history. Those results only mean no blocklist entry and no broken encryption — they say nothing about who receives the credentials.
The operator side is the problem. The page displays no company name, address, phone number or email, and no contact email was found on the captured page; the footer offers only Security Statement, Privacy Policy and Terms Of Use links. There is no one named to answer for what happens to a submitted password.
The page chrome never shows the hostname, so a visitor looking at the screen cannot tell they are on a vercel.app subdomain instead of the firm's real portal domain. A published security write-up describes users entering credentials on a fake login page of this kind.
Why the score is 12
02 · Security Evidence
Security evidence
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Visual warning signs were identified
Dark header bar reads "Authentication Technical Support Firm Portal" with a "Login" link at the top right and a "Help" link below it. Centered white card titled "AppSuite client" (rendered as 'AppSulte client' in page text) with Email Address and Password fields and a blue "Log in" button. The page asks the visitor to type an email address and password into a login form, with 'Forgot your Password?' and 'Not yet a member? Register here.' links beneath. Footer shows 'Security Statement', 'Privacy Policy' and 'Terms Of Use' links; no company name, address, phone or email is visible anywhere on the page. No visible hostname or domain is displayed in the page chrome, so a visitor cannot tell from the screen that the page is served from a vercel.app subdomain rather than securefirmportal.com.
What the captured page showed
5 observations- 01
Dark header bar reads "Authentication Technical Support Firm Portal" with a "Login" link at the top right and a "Help" link below it.
- 02
Centered white card titled "AppSuite client" (rendered as 'AppSulte client' in page text) with Email Address and Password fields and a blue "Log in" button.
- 03
The page asks the visitor to type an email address and password into a login form, with 'Forgot your Password?' and 'Not yet a member? Register here.' links beneath.
- 04
Footer shows 'Security Statement', 'Privacy Policy' and 'Terms Of Use' links; no company name, address, phone or email is visible anywhere on the page.
- 05
No visible hostname or domain is displayed in the page chrome, so a visitor cannot tell from the screen that the page is served from a vercel.app subdomain rather than securefirmportal.com.
Browser behavior
What our isolated browser recorded while it loaded the page. Host names only: no full addresses are published.
- Pop-ups
- 0
- Download attempts
- 0
- Notification prompts
- 0
- Navigations
- 1
- Other hosts contacted
- 2
Where the page went
- First loadsecurefirmportal.vercel.appSame site
Hosts on our aggressive-advertising list
None contacted.
Test clicks
No test click was made on this page.
What the page says about itself
Quoted from the pages we read: the site's own words, not our findings.
- Page title
Secure Firm Portal
Pages we read
- Main page/Read
- Terms/Account/TermsOfUseCould not be read
03 · Investigation Story
Investigation story
What the site claims
Secure Firm Portal
What we observed
The page content was captured and checked; the antivirus check returned no result for this scan.
What independent research found
4 external findings were saved and compared with the page evidence.
What remains unverified
1 of the 5 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Phishing & Impersonation
Service and business model
Login Portal
Observed behavior
Evidence behind this classification
- 01The hosting IP has an abuse confidence score of 0/100 across 99 saved reports, which reflects shared CDN infrastructure rather than this subdomain's operator.
- 02Centered white card titled "AppSuite client" (rendered as 'AppSulte client' in page text) with Email Address and Password fields and a blue "Log in" button.
- 03No visible hostname or domain is displayed in the page chrome, so a visitor cannot tell from the screen that the page is served from a vercel.app subdomain rather than securefirmportal.com.
- Also 7 listed under Why 12/100 above
Web research findings
Independent findings for securefirmportal.vercel.app, including public complaints, named review sources, registration records, and look-alike-domain evidence.
- PCrisk.comopen
"You entered credentials on a fake login page"
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too.
Infrastructure map
- Domainsecurefirmportal.vercel.app
- Redirects tosecurefirmportal.vercel.app
- Hosted byVercel, Inc
- Referencessecurefirmportal.com · submit-form.comand 5 more
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No direct contact email found on the captured page.
Domain & Encryption
At the scan on Nov 9, 2026: 10% of the validity period had passed
Certificate issued for *.vercel.app.
A shared content-delivery network address answers for many sites, so it is not the site's own server and says nothing about who runs it.
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1308http://securefirmportal.vercel.app/
- 2206https://securefirmportal.vercel.app/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
Grouped by what each domain is for. in page: named in the page’s HTML. contacted: the browser loaded it while rendering the page. ad list: on our aggressive-advertising list.
CDN & fonts2
- ajax.googleapis.comin pagecontacted
- stackpath.bootstrapcdn.comin pagecontacted
Platform & social1
- google.comin page
Other / unknown4
- cpasitesolutions.comin page
- securefirmportal.comin page
- submit-form.comin page
- mail.in page
05 · Evidence Ledger
Evidence ledger
- Antivirusunavailable
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | No usable engine result was saved | Unavailable | No saved finding | Not available |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Nov 9, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Nov 9, 2026 |
| Visual evidence | 5 visible observations saved with the page capture | Completed | Adverse | this scan · Nov 9, 2026 |
| Independent research | 4 independent findings were saved | Completed | Adverse | this scan · Nov 9, 2026 |
- Antivirus
- ResultNo usable engine result was saved
- CompletionUnavailableFindingNo saved finding
- FreshnessNot available
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 9, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 9, 2026
- Visual evidence
- Result5 visible observations saved with the page capture
- CompletionCompletedFindingAdverse
- Freshnessthis scan · Nov 9, 2026
- Independent research
- Result4 independent findings were saved
- CompletionCompletedFindingAdverse
- Freshnessthis scan · Nov 9, 2026
07 · Safety FAQ
Safety FAQ
Answered from the saved verdict and evidence in this report.
Is securefirmportal.vercel.app a scam or a legit website?
Is securefirmportal.vercel.app safe to use?
I already paid or entered my details on securefirmportal.vercel.app — what should I do?
Can I get my money back from securefirmportal.vercel.app?
Did securefirmportal.vercel.app steal my password or personal information?
How do I report securefirmportal.vercel.app?
securefirmportal.vercel.app looks professional — how can it still be a scam?
Is securefirmportal.vercel.app on any phishing or malware blacklists?
How old is the securefirmportal.vercel.app domain?
Where is securefirmportal.vercel.app hosted?
How often is the securefirmportal.vercel.app report updated?
08 · Final Verdict
Final verdict
Fake "Secure Firm Portal" login on a free Vercel subdomain sends typed email and password to a third-party form relay
This page copies the client-portal login used by accounting firms — an "AppSuite client" card with Email Address and Password fields, plus Forgot Password and Register links — but it is served from securefirmportal.vercel.app, a free hosting subdomain, while the real portal is documented at securefirmportal.com. The form does not authenticate anyone: it posts what you type to submit-form.com, an unrelated form-collection service. No operator name, address, phone or email appears anywhere on the page, and the only outbound help link points at the genuine vendor's help centre. A published security write-up describes exactly this pattern of entering credentials on a fake login page. The score is very low because the site's single purpose is to collect working logins.
09 · Community
Community
Are you the owner of securefirmportal.vercel.app?Verify and reply