What Gridinsoft observed on Usaestaportal.info
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260825212445-0411edfd
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Suspicious Website
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent current review supports Suspicious Website for usaestaportal.info. The site prominently discloses that it is a private third-party service and links the lower-cost official government route, and no current malware URL, file, payload, hash, forced download, unrelated redirect, or credential relay was reproduced. The current first-party basis is instead the transaction flow: the exact service fee and total remain hidden while the application begins collecting name, email, date of birth, and later passport data, and the current rush and super-rush values are lower than standard even though the interface describes them as additional charges. Those directly observed pricing-transparency contradictions support Suspicious Website without relying on external vendor labels. Historical public allegations were treated as context only and were not substituted for a current malicious sample.
Analyst findings
Review 7 documented observations View evidence
The HTTP and HTTPS apex redirected only to the related www host. Desktop, mobile, crawler, and command-line profiles reached the same current USA ESTA Portal page with HTTP 200 and stable content. Reviewed public navigation did not produce an unrelated destination, forced file download, or executable or archive object.
-
Redirect destination
https://www.usaestaportal.info/ -
HTTP status
200 - Page element Title: USA ESTA PORTAL | Launch ESTA Fast
- Analyst observation Four request profiles received the same site content; no reviewed profile produced an unrelated redirect, automatic download, executable, or archive.
The current homepage prominently stated that the service is a private third party, is not affiliated with the United States government, and that travelers can apply through the official government site at a lower cost. The footer repeated the private-service disclosure. The reviewed page therefore did not conceal its non-government status.
- Page element Prominent disclosure: private third-party service, not affiliated with the United States Government, with the official lower-cost application option linked.
-
Final URL
https://www.usaestaportal.info/
The public application flow did not show an exact service fee or total before the traveler-information stage. After advancing past travel dates without submitting data, the next step required first name, last name, email address, and date of birth, while the visible sidebar still said that the total would be calculated at checkout. The fee page likewise promised a checkout breakdown but displayed no numeric fee.
- Page element Traveler-information fields shown before an exact total: first name, last name, email address, and date of birth.
- Page element Visible total before traveler details: Calculated at checkout
- Page element The public fee page stated that a complete fee breakdown would be shown at checkout but listed no exact amount.
- Analyst observation The later public application sequence requests passport details before checkout; the review did not enter or submit identity, passport, or payment data.
The current application pricing response supplied the same values for multiple eligible countries: a USD 40.27 government fee, USD 229.73 standard processing, USD 208.73 rush processing, and USD 228.73 super-rush processing. The interface describes rush and super-rush values as additional charges, yet both are numerically lower than the standard value, producing internally inconsistent tier labels and totals.
- Analyst observation Current pricing values: government fee USD 40.27; standard USD 229.73; rush USD 208.73; super-rush USD 228.73.
- Page element The interface labels rush and super-rush processing as Additional even though their returned values are USD 21.00 and USD 1.00 lower than standard processing.
- Analyst observation The returned totals are USD 270.00 for standard, USD 249.00 for rush, and USD 269.00 for super-rush.
Current public navigation, redirects, page content, forms, and referenced client code did not expose a specific malware URL, file, payload, hash, automatic download, credential relay, or unrelated redirect. The present review therefore does not classify the domain as malware distribution and does not claim that a current malicious sample was found.
- Analyst observation No reviewed public page initiated an automatic download or exposed a specific malware file, payload, or hash.
- Analyst observation No current unrelated redirect or observable credential relay was reproduced in the reviewed public flow.
The apex and www host resolved to the same current address, and the reviewed HTTPS service presented a currently valid certificate covering both names. The domain was registered on July 28, 2026. DNS and TLS continuity were treated only as scope and recency context, not as evidence that the transaction flow is safe.
- DNS fact usaestaportal.info and www.usaestaportal.info A 193.233.63.101
- Certificate fact The reviewed HTTPS service presented a currently valid Let's Encrypt certificate covering usaestaportal.info and www.usaestaportal.info.
- DNS fact RDAP registration date: 2026-07-28
Exact-host and parent-domain searches covered public search indexes, URL scanners, malware sandboxes, threat intelligence, and web archives. urlscan listed three August records without a published malicious verdict; Cloudflare Radar showed no classification; OTX returned zero pulses; Wayback returned no available snapshot. No indexed object-level malicious URL or sample was found. A July public report alleged payment-card and geographically conditional price behavior, but its older price-display code was absent from the current script and the report withheld the claimed object-level hashes and destinations.
- Public artifact URL https://urlscan.io/domain/usaestaportal.info
- Public artifact URL https://otx.alienvault.com/indicator/domain/usaestaportal.info
- Public artifact URL https://web.archive.org/web/*/usaestaportal.info/*
- Public artifact URL https://griftfiles.com/usaestaportal-info.html
- Analyst observation Exact public searches in ANY.RUN, Hybrid Analysis, Triage, URLhaus, and ThreatFox exposed no indexed object-level malicious URL or sample for usaestaportal.info or www.usaestaportal.info.
- Analyst observation The July public report is historical allegation context rather than a reproducible current malware object; its older geography-dependent price-display logic was not present in the current client script.
Scope and limitations
- The review covered the apex and www host, public pages, redirects, client code, application navigation through the traveler-information stage, forms, DNS, TLS, search indexes, URL scanners, sandbox indexes, threat intelligence, and available public archive metadata at the recorded time.
- No identity, passport, payment-card, or other personal data was entered or submitted. The private authenticated dashboard and completed checkout response were not accessed, so the review does not claim to have tested payment processing end to end.
- Public URL-scanner, sandbox, threat-intelligence, and archive coverage is incomplete. Missing, access-restricted, or unindexed material was treated as a limitation rather than proof that no historical event occurred.
- The July public report did not disclose the exact claimed payment destination, executable sample, payload, or hash. Its older geography-dependent price-display logic was not present in the current script, so its more serious historical allegations were not independently reproduced.
- Suspicious Website describes the current public transaction-transparency risk. It is not a claim that every page is malicious or that a current malware sample was identified.
Help protect others by sharing this page on social media! The more people who know about usaestaportal.info, the fewer chances they have to deceive someone else. Help others evaluate usaestaportal.info by sharing this page on social media!