Is portal-moonshot-0w6.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The site at this address is a freshly provisioned subdomain on the Netlify hosting platform. Its homepage serves only the platform's generic "Site not found" 404 screen, which says the requested path does not exist and invites visitors to build and deploy their own site. It shows no products, branding, forms or links, and no business model can be inferred. It appears to be a placeholder or abandoned deployment slot, not an operating business.

Scam/Impersonation Risk

Contradictory signals are present and severe. Several independent security engines currently flag this host as malicious, and one suspicious verdict was also returned. One of the flags comes from a major tier-one security vendor. This amounts to a confirmed blacklist listing. The hostname is a very young, auto-generated subdomain under a shared hosting namespace, and its "portal-moonshot" naming resembles a staging or login-portal label. Rendered in the sandbox, the homepage looks like an inert error screen. The behavioural sandbox nonetheless recorded hidden forms in all three runs, with password-form presence, and about 4,130 DOM mutations after interaction. A static 404 would produce neither. The sandbox also flagged a final-destination mismatch. Together these point to a dormant staging shell that can be switched to credential-harvesting content without notice. The four abuse reports on record apply to a shared provider address, not to this site specifically. They are secondary context only and are not counted as a finding against the site. No conflicting legal identities were observed. The decisive concern is the external threat detections combined with the hidden-form and content-mutation behaviour. Evidence:

• Homepage: the visible content is a bare "Site not found" 404 notice with no navigation, claims or contact details, yet the sandbox logged hidden forms in 3 of 3 runs.
• Homepage behaviour: 4,130 DOM mutations after interaction, 3 console errors and 36 external requests in a page that visibly contains almost nothing. A destination mismatch was also flagged.
• Reputation: 5 malicious and 1 suspicious detections from external engines, including a tier-one vendor. Abuse reports total 4, against a shared hosting address.
• Provenance: the domain was first observed on 2026-10-07 (about 13 days old), with a single archive snapshot and 1 year tracked. DNS characteristics are ephemeral and fast-flux-like, with a TTL of about 116 seconds.

Regulatory Verification Notes

The site publishes no legal, about, terms, privacy or contact pages, and it names no operating company, registration number or licensing authority. Its ownership and governance are therefore opaque, and the real-world operator is not independently connected to any identifiable brand or person. The certificate is valid, but it is an organization-validated certificate whose subject is the hosting platform. It attests to the platform, not to whoever controls this subdomain. No third-party broker or regulator record matched this site, and the site claims no licence of any kind. The absence of disclosures is a verification gap and is not by itself evidence of fraud. The external threat detections above are what drive the cautionary assessment. Evidence:

• Homepage: contains no company name, address, licence reference or policy pages of any kind.
• Hosting: served from AS16509 (Amazon, AMAZON-02, US).
• Transport encryption: the TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), with subject organization Netlify, Inc and validity to 2027-03-19.

What to Verify Next

Sensitive interactions should be deferred until an independent party establishes who operates this subdomain and why it is receiving threat detections. The relevant checks are whether the intended owner exists and controls this deployment, and whether the listings have been cleared. If the site is expected to belong to a known organization, its official address should be confirmed through an independent, offline route such as a published corporate directory or a direct call. Any claimed licence should be checked directly with the relevant registry. It should not be taken from this site, which names none. Official support and contact channels should be confirmed independently before any correspondence is initiated. Evidence:

• Homepage: no operator, licence or contact information is available to check against, so confirmation has to come from outside the site.
• Reputation: the active external detections should be re-checked after any claimed clean-up before the host is treated as safe.
• Behaviour: the hidden-form activity should be re-tested if the host's content changes.

Summary Verdict

The overall posture is high-risk and clearly cautionary. Active external threat detections, hidden-form behaviour and heavy post-load page mutation on an unverified, days-old host converge on a site that cannot be treated as trustworthy. The valid certificate and clean-looking rendered page do not offset these signals. The legitimacy of the site and its operator remains unestablished.

Infrastructure Integrity

The host sits behind AWS content-delivery edge infrastructure, and all four observed addresses are edge nodes. The origin server was not observable, so independent verification of the underlying host is not possible. This protective infrastructure is a mitigating factor only. It does not offset the reputation risk, and it can allow content to be swapped quickly behind a stable edge address. The platform-level hosting is mainstream and the transport encryption is valid, but neither speaks to the intent of whoever controls this subdomain.

Closing Assessment

Logging in, entering credentials, making payments or any other financial interaction with this host should be avoided. Any visit should be limited to passive viewing in an isolated environment, and nothing should be downloaded from it. Re-assessment is appropriate only after the external listings are cleared and an accountable operator is independently identified.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.