Is portal-moonshot-033.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared, third-party site-hosting platform. Its captured homepage is the platform's generic "Site not found" error page, which says the requested address does not exist there. The page presents no products, pricing, company information, or sign-up or payment flow, and no business model can be inferred from it. The subdomain name suggests a "portal" or access point, but the capture shows no content that explains its purpose or operator.

Scam/Impersonation Risk

Material contradictions are present, so this assessment is clearly cautionary. Multiple independent security engines currently flag the site as malicious, including two tier-one security vendors, which amounts to a confirmed blacklist listing. The hosting-error page's name and content closely resemble the hosting platform's own branding, and the analysis flagged possible brand lookalike behaviour. In repeated sandbox sessions the page also contained concealed forms, including password-type fields, even though the visible page is only a static error notice. It also underwent an unusually large amount of page restructuring after interaction. A harmless 404 page would not normally do either, so the visible content does not match the behaviour observed. This pattern is consistent with a credential-harvesting setup staged behind a placeholder, although the capture does not prove that. Four abuse reports exist against a shared hosting-provider address associated with the site. They apply to infrastructure that many unrelated tenants use, so they are not attributed to this operator and are weaker evidence than the engine detections. No conflicting legal identities were found, and no impersonation of a named financial brand was observed. The risk comes from the confirmed threat listings and the hidden credential-capable forms. Evidence:

• Homepage capture: a hosting-platform "Site not found" page with about 368 characters of text, no login form visible, and no contact, legal, or product content.
• Eight security engines flagged the domain as malicious, two of them tier-one vendors, and the domain also appears on an external blacklist.
• Sandbox behaviour: hidden forms were detected in 3 of 3 runs, with 3 password forms and 4,130 page mutations after interaction.
• Four abuse reports are tied to a shared provider address, not to this site alone.

Regulatory Verification Notes

The captured page carries no legal, identity, licensing, or registration information. It names no operating company, address, terms page, or regulator, so no real-world operator can be linked to the site, and independent identity verification is unconfirmed. This is a verification gap and not, by itself, evidence of wrongdoing. Combined with the threat listings above, however, no basis exists for treating the site as a regulated or accountable counterparty. Because the site offers no financial products on the captured page, no licence claim exists to test. No third-party broker or regulatory-database entry matched this domain. Evidence:

• Homepage capture: no company name, licence number, jurisdiction, privacy policy, or terms of service.
• Hosting facts: the site is served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: an OV-validated TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19. It belongs to the hosting platform, not to an independently identified operator.
• A broker-reputation database lookup returned no match for this domain.

What to Verify Next

Do not interact with this address until its operator is independently identified and the security listings are resolved. Anyone who received this link in an email, message, or advertisement should confirm with the sender, through a separately known channel, that they sent it and what the site is for. If the link claims to represent a specific company, that company's official website should be reached by typing its address directly, and its published support route should be used to ask whether this subdomain is legitimate. Anyone who has already entered a password or other credentials here should change them at the real service and enable multi-factor authentication. Security teams can re-test the address later to see whether the threat listings clear. Evidence:

• Hidden password-type forms were present in every sandbox run, so no credential should be considered safe to submit.
• The page shows no operator identity, so the origin of any link pointing here cannot be confirmed from the site itself.

Summary Verdict

The overall posture is high risk. Confirmed threat listings and concealed credential-capable forms are the decisive factors. The valid certificate and recognised hosting environment do not offset them, and the site's identity remains unverified. The evidence does not support treating it as a legitimate service.

Infrastructure Integrity

The site sits behind AWS-operated edge infrastructure, and all four observed addresses belong to the CDN/WAF layer, with no origin server visible. This protection is a mitigating factor only. It does not establish legitimacy, and edge-only visibility prevents independent confirmation of what the content is actually hosted on and makes it easier to change that content quickly. The valid OV certificate and stable responses are routine platform features and do not outweigh the reputation findings.

Closing Assessment

At most, the address may be viewed passively from an isolated, non-sensitive environment. No login, credential entry, personal data submission, or payment should take place here, and downloads should be avoided. Links to this address should be reported to the security team or to the hosting platform's abuse channel.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.