Is portal-moonshot-2qw.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on the Netlify static-hosting platform. It currently serves only the platform's generic "Site not found" error page, which says the requested site or path does not exist. A visitor sees no products, services, pricing, company information or navigation. The only call to action is Netlify's own prompt to build and deploy a site for free. No business model or purpose can be inferred from what is published.

Scam/Impersonation Risk

Several independent contradiction signals are present, so the posture is clearly cautionary. The domain is blacklisted: multiple security engines classify it as malicious, including a tier-one security vendor, and a separate external blacklist indicator is also confirmed. This is the decisive factor, and the benign-looking error page does not offset it. A threat listing against a page with no visible content points to a placeholder, a dormant staging address, or a deployment that has been swapped, emptied or taken down. It does not point to a verified legitimate service. The page is also not behaviorally inert. Across all three sandbox runs, hidden forms and password-form elements appeared on a page whose visible text and structure describe no form at all. The page also produced a very large volume of DOM mutations after interaction, which is out of proportion to a static 404 template. This discrepancy between visible content and runtime behavior is consistent with content being injected or swapped after load. The sandbox found no wallet-drainer, clipboard-hijack, fingerprinting or cloaking behavior. Page-level analysis also flagged a lookalike relationship to the hosting platform's brand name. The visible text is the genuine platform error template, so this is not a confirmed brand impersonation, and no conflicting legal identities exist. A malicious-listing finding combined with unexplained hidden credential-type forms is nonetheless a serious combination for a site whose operator cannot be tied to any real-world brand or person. Evidence:

• Homepage: the only visible content is the generic platform 404 message with no services, forms or contact details, yet the sandbox detected hidden forms in all three runs.
• Homepage runtime behavior: password-form elements and thousands of DOM mutations after interaction, despite a 368-character static error page.
• Reputation checks: six malicious detections across the security-engine panel, with a tier-one vendor among the flagging sources, plus a confirmed external blacklist indicator.
• Page analysis: lookalike similarity to the hosting platform's brand name was flagged, but the page content is the unmodified platform template and no impersonation was confirmed.

Regulatory Verification Notes

The site presents no legal, terms, privacy, about or contact pages. It claims no license, registration number, regulator or operating entity, so none of these can be assessed. Because the real page is only a platform error template, this absence reflects the lack of any published business rather than a withheld disclosure. No third-party broker or regulatory-database record matches the site. The operator's real-world identity is therefore unverified and cannot be inferred from the site. The technical foundation is orthodox, but it supports only the hosting arrangement and not the operator's legitimacy. Transport encryption is valid and uses an organization-validated certificate issued to the hosting platform itself, not to any independent business behind the subdomain. Evidence:

• Homepage: no legal entity, license, registration number, address or policy pages are published.
• Served from AS16509 (AMAZON-02, Amazon.com, Inc., US) in the ARIN registry region.
• TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV validation), subject organization Netlify, Inc, valid to 2027-03-19 (149 days remaining).
• Third-party broker intelligence: no match for this site.

What to Verify Next

Verification should start with the site's origin and purpose, since nothing on the page supports either. Whoever supplied this address should be asked, through a channel independent of the link itself, to confirm who operates it and which published site it is meant to represent. The official domain of the claimed organization should then be located through an independent source such as a known corporate website, a regulator register or a prior verified communication. Its deployment should be compared against this address. Any message, invitation or login prompt that routed to this address should be treated as unconfirmed until the sender is validated by another route. Official support and contact channels should be confirmed offline. Evidence:

• Homepage: no operator, product or contact information is published that could be cross-checked.
• Runtime behavior: hidden form elements that the visible page does not explain, which an operator should be able to account for.
• Hosting: the subdomain label is a generic portal-style name with no link to any identifiable organization.

Summary Verdict

The site carries an elevated risk posture. Confirmed adverse reputation findings and unexplained hidden-form behavior outweigh the otherwise standard encryption and hosting. The operator is unidentified and the page offers no legitimate content to counterbalance these findings.

Infrastructure Integrity

The site is delivered from Amazon-operated address space behind the platform's AWS-based CDN/WAF layer, and all four observed addresses are edge servers. The origin server was not observable. Edge-only visibility prevents independent confirmation of the hosting arrangement and can mask rapid content swaps. This protective layer is a mitigating factor only and cannot offset the reputation findings. A small number of abuse reports (four) are attached to one of the edge addresses. They apply to shared provider infrastructure, so they say little about this specific site and carry limited weight beyond the independent detections.

Closing Assessment

Interaction with this address should be limited to passive viewing. No credentials, login details, personal data, payment information or wallet connections should be supplied, and nothing should be downloaded from it. If it was received through an unsolicited message or link, it should be reported to the sender's organization and the originating platform.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.