Is ais.usvisa-info.com site a scam visa site for US consulate in Canada?

Boy, they're not helping you authenticate the site at all. They are literally doing everything they could possibly do to make the site look fake. facepalm

Cough cough, maybe somebody from General Dynamics or Congress will notice this nonsense, and clean it up. Good grief.

In favor of legitimacy

An army of people saying "No! No! It's legit!" - that is what it is.

The fact that dozens of government web sites link to it (thank you Doc). A few might be hacked or been tricked with social engineering, but a large number of sites makes that far less likely.

The domain registration having existed for 15 years (thanks again Doc) - vanishingly unlikely a scam site could stand that long. Note also that some of those links from .gov sites are quite old as well.

The IP address block is allocated to a section of AWS dedicated to government service.

Against legitimacy.

Aside from what I present below, there's an abrupt, almost neck-snapping gearshift in writing style on those two links - the rest of the page is clearly written to a well-refined style guide, and suddenly they say "click here". What?? No.

Add to it that they're on the wrong TLD (should be .gov) and their domain is anonmymous for no darn reason. Just because a government site links to you doesn't mean the government site wasn't hacked. That happens all the time IME.

Top banner of www.state.gov. Why doesn't it say that? Hmm.

Domain names publish registry information.

Every domain name has a publicly accessible registry of a) who owns the domain, b) who is the technical manager of the server, and c) who administers the content. Their name, street address, email and phone are given. This is accessible at any unix prompt with whois. For example, here is an excerpt of apple.com WHOIS data.

Registrant Organization: Apple Inc.
Registrant Street: One Apple Park Way
Registrant City: Cupertino
Registrant State/Province: CA
Registrant Postal Code: 95014

Straightforward enough, eh? The address checks out; it's famous.

Many citizens (and many more scammers) don't want their street address splashed on their WHOIS info. So most domain registrars let you check a box that says "anonmyize my registration". This means a "private registration service" will be given as your contact info. Presumably the service will forward any legal notices they receive?

While it prevents stalkers, it also greatly helps scammers and acts as a general "lawsuit wall" because the suer must convince the court to compel the service to give up your true identity - and for all they know, you lied! Seriously, go buy a Visa gift card for cash at a grocery store, and sign up for a domain name with made-up info and tick "anonymous reg". What stops you? Nothing.

But on the other hand, many people registering domains choose "anonymous" pretty much automatically as a knee-jerk. So who's to say their web designer didn't just do that out of habit, without thinking?

So, let's look at this site's WHOIS info.

Domain Name: USVISA-INFO.COM 
Registry Registrant ID: Not Available From Registry 
Registrant Name: Whois Agent 
Registrant Organization: Domain Protection Services, Inc. 
Registrant Street: PO Box 1769  
Registrant City: Denver 
Registrant State/Province: CO 
Registrant Postal Code: 80201 
Registrant Country: US 
Registrant Phone: +1.7208009072 
Registrant Fax: +1.7209758725 
Registrant Email: https://www.name.com/contact-domain-whois/usvisa-info.com 
Registry Admin ID: Not Available From Registry 
Name Server: ns-535.awsdns-02.net 
Name Server: ns-1754.awsdns-27.co.uk 
Name Server: ns-475.awsdns-59.com 
Name Server: ns-1299.awsdns-34.org 

Yup, that's a typical "anonymous registrar" alright. And what's up with the name servers? Why is a US government name server in the UK?

"But this is run by a contractor".

Supposedly General Dynamics. OK. But again, why the anonymity? Really. General Dynamics doesn't have the pull to get us-visa.GOV? Of course the State Department (their customer) administers *.usembassy.gov and *.state.gov.

General Dynamics (GD.com, think of the power you need to get a 2-letter TLD)... also uses anonymous domain registration - which might help us if they used the same privacy service... but they didn't. SMH.

DNS servers? Totally different.

So yeah, this is not great. It really is a challenge to authenticate this site.

Why making it hard matters.

SMH, if it wasn't for the exculpatory information pointed out by Doc, my money was on "No way, José". It just stinks way too much.

I see government sites get "hacked" all the time because I spend a lot of time dealing with "tail queries" - queries with few results. Many of them will only have results which are keyword spam on URLs in obscure, hidden directories on sites that have no reason to have that content - and many end with .edu and .gov. That got there by cracking the sites. Not every government website is secure.

But for that matter, government procurement is public - it would take little for a scammer to read about a project, set up a fake site, and then use social engineering to trick site webmasters to add their link instead of the genuine article. Then they sit there and collect your personal info.

That would eventually be noticed if the site didn't work, but they could make it work by taking your submitted info and submitting it to the genuine site. This is called "Man in the Middle" attack.

The odd phrasing of those links, as compared to the rest of the site, is particularly rankling because the site is obviously prepared with a rather tight style guide. It has the air of either a hack done by outsiders, or an employee other than the normal webmaster being tricked into inserting them.

TL;DR - This website is 100% legitimate.

The US government outsources some parts of the visa issuance process to external commercial companies. Exactly what this includes varies from country to country, but generally includes things like appointment scheduling, return delivery of passports, and various other customer-support functions.

The companies that carry out these functions varies depending on the country, however there are 2 main companies that perform these functions :

• CGI Federal (under the name 'US Travel Docs'), via the website ustraveldocs.com, and
• GDIT (under the name 'Applicant Service Centers'), via the website usvisa-info.com

Both CGI Federal and GDIT are major government outsources, and both of these websites have existed for the purposes of US Visa applications for over 10 years.

Most US Embassy websites will include links to the relevant site for the country that you are applying in. Based on your comments it seems that the Canadian US Embassy website doesn't do that (or at least, not in an obvious way), however most other US Embassy websites now include a 'wizard' that works for all countries.

For example, picking the US Embassy in Ireland for example, you can go to the URL https://ie.usembassy.gov/visas/#wizard, select the country you wish to apply in (in your case, Canada) and it will confirm that https://ais.usvisa-info.com is indeed the correct website you should be using. As this information is coming from an official US government website (usembassy.gov) you can be confidant it is correct.

(If you don't trust the Ireland website for some reason, you can replace the "ie" in the URL with most other country codes to get to the same information, such as "au", "nz", "km" or "de" for Australia, New Zealand, Comoros or Germany respectively - just unfortunately not "ca" as Canada seems not to be following the standard website layout that other US embassies are)

On its "Entering the US" page, the US Embassy in Canada links to https://ais.usvisa-info.com/en-ca/niv with the text "Click here to start your non-immigrant visa application", so I would not worry about visiting that website if you want to apply for a US visa from Canada.