No Way to Tell a Supplier's Legitimate-Looking Website Has Been Silently Compromised to Serve Malware

Summary

Buyers doing pre-payment due diligence on a supplier often visit the supplier's site as a routine, supposedly safe step — only to be hit by a hijacked page serving a fake CAPTCHA that tries to run a PowerShell malware downloader. The site looks entirely legitimate (it belongs to a real, established wholesaler like Fienza), so nothing about the supplier's identity, track record, or 'freshness' signals that the domain is currently dangerous. There is no affordable tool that, when you paste a supplier or partner URL, tells you whether the site is currently compromised, spoofed, or actively serving malicious payloads — and standard due-diligence workflows just assume visiting the supplier's site is a harmless first step. This gap is unsolved and high-stakes: it exposes procurement staff, indie founders, and SMB buyers to malware, credential theft, and ransomware simply as a side effect of trying to vet a counterparty, and it maps directly to SupplierProof's 'paste a supplier website' promise, which today cannot certify that the site itself is safe to interact with.