Independent website safety report covering the connection, domain history, browser protections, page behavior and reputation signals observed by DarkOra.
DarkOra separates technical evidence from community opinion and explains the factors behind the score.
The available evidence contains more reassuring signals than material concerns. Its TLS certificate was valid at scan time. The accessible homepage exposed no clear contact route and linked policy or company information. Confidence is high based on 7 distinct evidence groups collected during the latest scan. The result is a risk assessment, not proof that gov.br is legitimate or fraudulent.
Valid TLS certificate observed
5 of 6 monitored headers
MDN HTTP Observatory result
Review both columns. A high total score does not cancel a material caution signal.
The certificate is trusted, matches the hostname and is currently valid.
TLS · transport · +7 pointsThe final page is delivered through an encrypted HTTPS connection.
Transport · transport · +4 pointsThe scanned destination returned HTTP 200.
HTTP · transport · +3 pointsThe response includes the strict-transport-security header.
Security headers · security · +2 pointsThe response includes the content-security-policy header.
Security headers · security · +2 pointsThe scanner received a usable HTML homepage rather than an interstitial or access-control page.
Content · behavior · +2 pointsThe accessible homepage did not contain the monitored high-pressure or credential-request phrases.
Content · behavior · +2 pointsThe domain resolves to 2 validated public network addresses.
DNS · domain · +1 pointsAt least two authoritative nameservers were found.
DNS · domain · +1 pointsAt least one mail-routing or anti-spoofing control was found.
DNS · domain · +1 pointsGoogle Public DNS returned authenticated DNS data for this hostname.
Google Public DNS · domain · +1 pointsRIPEstat mapped the address to AS10954 and prefix 161.148.164.0/22.
RIPEstat · domain · +1 pointsThe response includes the x-content-type-options header.
Security headers · security · +1 pointsThe response includes the referrer-policy header.
Security headers · security · +1 pointsFraming is restricted through X-Frame-Options or CSP.
Security headers · security · +1 pointsThe homepage provides a usable browser title.
Content · transparency · +1 pointsThe homepage includes a descriptive meta summary.
Content · transparency · +1 pointsAt least one policy or company-information page was found.
Content · transparency · +1 pointsThe website publishes a non-empty robots.txt file.
Public files · transparency · +1 pointsThe scanned page contains enough readable text to explain its purpose.
Content · transparency · +1 pointsRedirects remain within the same domain family.
HTTP · behavior · +1 pointsThe page declares a canonical destination.
Content · transparency1 hidden or zero-sized iframe was found.
Content · behavior · -6 points3 insecure active resource references were found on the HTTPS page.
Content · security · -3 pointsPublic RDAP data did not provide a reliable registration date.
RDAP · domain · -1 pointsMDN HTTP Observatory assigned grade D-, indicating weak browser hardening.
MDN HTTP Observatory · security · -1 pointsNo clear email, telephone or support route was detected on the homepage.
Content · transparency · -1 pointsThe response did not include this browser security header. Missing headers affect hardening, but do not by themselves prove fraud.
Security headers · securityThese values were captured at scan time and may change after a server, DNS or certificate update.
Provider failures stay separate from the base scan. DarkOra never fabricates a provider result.
The AD flag confirms that the DNS answer was validated through DNSSEC.
Response code 0 · 2 answersMDN evaluated the live HTTP security configuration independently from DarkOra.
25 points · 9/12 tests passedThe hostname is not currently confirmed as preloaded. This alone is not a scam indicator.
Independent transport-hardening contextThe scanned address maps to prefix 161.148.164.0/22.
BGP present · registry presentThe optional official Web Risk integration is not configured.
Checked Oct 9, 2026Trustpilot requires an official API key. DarkOra does not scrape profile pages.
Open Trustpilot profilePlain-language answers explain what the score can and cannot tell you.
The available evidence contains more reassuring signals than material concerns. Its TLS certificate was valid at scan time. The accessible homepage exposed no clear contact route and linked policy or company information. Confidence is high based on 7 distinct evidence groups collected during the latest scan. The result is a risk assessment, not proof that gov.br is legitimate or fraudulent.
The latest DarkOra website safety score is 70 out of 100, classified as Low observed risk. The score reflects observable technical and reputation evidence collected during the latest scan.
DarkOra uses six independently capped areas: connection and TLS, domain maturity and DNS, browser security, identity and transparency, page behavior, and external reputation. No single signal determines the entire score.
The report was last updated on October 9, 2026. Website, DNS and certificate settings can change after this time.
No. Automated evidence can reduce uncertainty, but it cannot prove ownership, product quality or honest intent. Verify the organization, payment destination, refund terms and independent reputation before sharing sensitive information.
Account-linked reviews are screened for spam and published only after manual moderation.
Be the first member to describe a direct experience with this website.
Sign in with your DarkOra account to submit a moderated review.
Sign in to reviewUse this report as one part of your decision. Automated checks can miss newly created threats and may flag legitimate configurations. Verify the organization, payment recipient, refund terms and independent reputation before sharing money, credentials or sensitive data.