nextcloud.moritzcorpus.de
Category: Technology
Not checked: nextcloud.moritzcorpus.de showed the file scanner only a script, not its page.
Description of nextcloud.moritzcorpus.de
This domain appears to host a Nextcloud login portal on the subdomain nextcloud.moritzcorpus.de. Based on the screenshot, the page is presented as a file-syncing and cloud storage access point where users would sign in with an account name or email address and password. Nextcloud is commonly used for private or organizational file sharing, calendars, contacts, and collaboration services.
The operator is not clearly identified in the visible page content, but the parent domain suggests it may be associated with an entity or individual using the moritzcorpus.de domain. We could not see the site's real page in a scanner context because it appears to hide its content from security scanners, so this description is based mainly on the browser-visible login screen and the domain structure rather than a full crawl of the site.
Safety Assessment for nextcloud.moritzcorpus.de
Security scan results were mixed in an important way. On one hand, no threats were detected by the malware scan, no security engines flagged the domain at the time of this scan, and the checked threat databases did not report listings. On the other hand, the site appears to hide its real page from security scanners by serving different responses to automated inspection and normal browser access.
That behavior is a notable caution signal because hiding the real page from security scanners is a common trick used by scam sites and other deceptive operations. In situations like this, clean results from the other checks mean less than they normally would, since scanners may not have been shown the same content a visitor would receive. Visitors should therefore be very careful with this site, especially because it presents a login form that could collect credentials.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is served over HTTPS with a valid SSL/TLS certificate issued by Google Trust Services, with certificate expiry shown as 2027-01-11. It appears to be proxied through Cloudflare, using Cloudflare nameservers and infrastructure, with the observed server IP geolocating to Canada. DNSSEC appears to be unsigned.
A key technical concern at the time of this scan is response cloaking: automated scanning reportedly received an HTTP 404 response while a browser received an HTTP 200 page with substantially different content length. That kind of differential behavior can complicate security analysis and may reduce confidence in otherwise clean scan results.
Share your experience with this website. Was it safe? Did you encounter any issues?