Is portal-moonshot-3an.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a subdomain on the Netlify hosting platform. When visited, it returns only the platform's default "Site not found" 404 page. The page tells the visitor that the link is broken or that no site exists at that address, and it points to Netlify's troubleshooting guide and an invitation to build a site for free. It shows no products, services, pricing, branding or operator information, so its commercial purpose and business model cannot be determined from what it publishes.

Scam/Impersonation Risk

Contradictory signals are present and material. The address has been blacklisted by external security intelligence: several independent detection engines, including a tier-one security vendor, classify it as malicious or suspicious. That convergence is the decisive adverse finding. Two abuse reports were also logged against an address in the hosting provider's shared pool. These were discounted because they attach to shared infrastructure and not to this site specifically. They do not add to the case, but they do not weaken the blacklist finding either. The domain is extremely new and has almost no independent history, which fits throwaway or staging-style use of a free-hosting subdomain. In repeated sandbox runs the visible page also behaved very differently from its content. The static page shows no forms, yet every run detected hidden forms, including password-bearing fields, along with a very large burst of page changes after interaction and heavy outbound request activity. No phishing, brand impersonation or conflicting legal identities were confirmed. The hosting-platform name appears in the address only because the site is a subdomain of that platform. The hidden credential-capable forms behind an empty-looking page remain a serious concern. Evidence:

• Homepage: it serves only the hosting platform's default 404 page, with 368 characters of visible text and no declared forms, offers or claims.
• Sandbox behavior across three of three runs: hidden forms detected, three password-form elements present, and 4,132 page mutations after interaction.
• Domain provenance: first observed 2026-10-04 (~14 days old), with 1 archive snapshot in 2026 and 1 year tracked.
• External reputation: multiple malicious and suspicious detections, with a tier-one vendor among them, produced a confirmed blacklist.

Regulatory Verification Notes

The site publishes no legal, identity or licensing information. It has no terms page, about page, company name, registration number or regulator reference, so its operator cannot be identified from the site itself. This is a verification gap and not evidence of wrongdoing in itself, because the visible page is only a hosting error response. No financial service is offered, and no third-party broker or regulatory record was matched, so there is nothing to confirm or contradict. The valid encryption certificate belongs to the hosting platform, not to the site's operator. It shows that the connection is encrypted and says nothing about who runs the site or whether the site is legitimate. Evidence:

• Homepage: no company name, licence, registration number or contact channel is published.
• Hosting: the site is served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: the TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc., and valid to 2027-03-19 (151 days remaining).
• Broker reputation: no matching third-party broker record exists, so no reputational context is available either way.

What to Verify Next

The first step is to establish through an independent, offline route why this address was supplied, for example by phoning the person or organisation that sent the link on a number taken from a trusted source. Anyone claiming to represent a known brand should be asked for its official domain, and that domain should be reached by typing it directly. Any later claim of licensing or corporate registration on this address should be checked in the relevant regulator's own registry and not through links on the site. Because the address is newly created and its behaviour was anomalous, it should be re-assessed after some time. If it is later populated with real content, a fresh review is needed before any trust is extended. Evidence:

• Homepage: it carries no operator or contact details, so no channel exists on the site to verify against.
• Sandbox runs: hidden credential-capable forms were seen, so any login prompt later appearing here must be treated as unverified.
• Archive history: only a single snapshot exists, so there is no prior content to compare against future changes.

Summary Verdict

The site carries an elevated, clearly adverse risk posture. Confirmed external blacklisting and concealed credential-capable behaviour outweigh its limited positive technical hygiene. Its operator is unidentified and its history is minimal, so there is no evidence on which to base trust.

Infrastructure Integrity

The site sits behind Amazon-operated edge infrastructure with a protective CDN/WAF layer. All four observed addresses are edge nodes and no origin server was observable, so hosting cannot be independently verified, and the edge-only view can mask rapid content swaps. The infrastructure is reputable and is a mitigating factor for transport and availability, but it cannot offset the external reputation findings.

Closing Assessment

This address should not be used for login, credential entry, payments or any financial interaction. Any prompt on it asking for a password, wallet connection or personal data should be declined. If the link arrived unsolicited, it should be treated as untrusted and reported to the hosting platform's abuse channel.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.