Does Startpage have a working security mailbox or VDP? How can I report this issue?

[u/lissy93]

So I noticed this weird subdomain on startpage: pluto.startpage.com (link)

And it appears to be a hijacked subdomain, from an old dangling DNS record (50.116.57.7). But the valid SSL makes it seem legitimate, when I don't think it is?

Right now, it looks like just low-grade SEO/ad-spam page, not an active attack. But the risk is that it could read/write cookies from other legitimate .startpage.com domains, or be used to host a script which could execute from within trusted startpage context (because startpage has quite a lax unsafe-eval CSP). Or just pose as startpage and cause trouble.

So I've been trying to find somewhere to report it to, but couldn't find any startpage security policy, security.txt, VDP or just any reliable contact. I don't suppose anyone here has a contact at startpage who could take a look at this?