Is portal-moonshot-3z2.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a default Netlify "Site not found" error page served from a Netlify-assigned subdomain, with a randomized, portal-style hostname. It shows no business description, products, branding or contact details, so no operator or purpose is visible. Its only content is a message that the requested path does not exist on the platform, a pointer to Netlify's troubleshooting guide, and a "Start building" prompt.

Scam/Impersonation Risk

Contradictory signals are present and drive a clearly cautionary assessment. Several independent threat-intelligence sources currently flag the hostname as malicious or suspicious, and one major security vendor is among them. This is a confirmed blacklist condition rather than a soft reputational note. The page also behaves unlike an ordinary error page. Across all three sandbox runs, hidden forms were detected, and password-type form elements were recorded. Interaction also triggered an unusually large number of DOM mutations, which a static 404 message does not explain. That pattern fits a placeholder that can swap in credential-collection content, or a page that serves different content to automated visitors. Cloaking was not detected, though. The hostname closely resembles the hosting platform's own domain, which raised a brand-lookalike suspicion, but no conflicting legal identities or confirmed impersonation of a named brand were found. Four abuse reports are recorded against a shared provider address. They are attributed to shared infrastructure, so they carry little weight about this operator. The external network traffic observed was heavy, but none of it went to non-whitelisted destinations. Evidence:

• Homepage: the visible content is only the platform's 404 message, with no business content, yet hidden forms were detected in every sandbox run.
• Homepage behavior: password-type form elements and very large post-interaction DOM changes were recorded on a page that otherwise shows only an error notice.
• Threat-intelligence reputation: multiple sources rate the hostname malicious or suspicious, and one major security vendor is among them.
• Hosting infrastructure: four abuse reports against a shared provider address, attributed to shared infrastructure.

Regulatory Verification Notes

The page contains no legal, identity, terms, privacy or licensing content, and no company name, registration number or regulator is presented. The real-world operator is therefore unverified, and ownership and governance opacity are both present. This is a verification gap and is not, on its own, evidence of wrongdoing. The page makes no financial or regulated-service claims, and no third-party broker or regulatory-database record corresponds to it. The valid organization-validated certificate is issued to the hosting platform rather than to any independent operator, so it confirms the platform's identity and not that of the site's owner. Evidence:

• Homepage: no operator name, legal entity, license or registration is disclosed, and no policy pages are reachable.
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).

What to Verify Next

The hostname should be treated as unresolved until its owner and intended content are established independently. First, anyone who received this address in an email, message, advertisement or QR code should obtain the intended destination from the sender through a separate, trusted channel, and should not rely on the link itself. Second, if the address is expected to belong to a known organization, that organization should confirm through its official channels that it controls the hostname. Third, if the address is part of one's own deployment, the owner should confirm whether the site was removed or misconfigured, and should check for unauthorized content, forms or scripts. Fourth, if the intended service is financial or regulated, its license should be checked directly with the relevant registry before any engagement. Evidence:

• Homepage: the site presents no destination content, so the intended service cannot be confirmed from the page.
• Hostname: the randomized, portal-style name and its resemblance to the platform's own domain give no basis for attributing it to a known entity.

Summary Verdict

The assessment is elevated risk. Confirmed adverse reputation from several independent sources, combined with anomalous form and page-behavior signals on an otherwise contentless page, outweighs the technical hygiene signals that are present. Legitimacy cannot be inferred, and the operator remains unidentified.

Infrastructure Integrity

The hostname resolves to Amazon-operated infrastructure behind a recognized CDN/WAF layer. Every observed address is an edge node, and no origin address could be seen. That is a mitigating factor, but it also prevents independent verification of the true hosting origin. Protective infrastructure does not offset the external threat detections.

Closing Assessment

The site should be limited to read-only viewing at most. No login, credential entry, form submission or financial interaction should take place, and nothing should be downloaded from it. Anyone directed here by an unsolicited message should disregard the link and report it to the supposed sender and to the hosting platform's abuse channel.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.