Is portal-moonshot-4mv.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a free application-hosting platform. Its name suggests a "portal", but it currently serves only the platform's generic "Site not found" error page. The page has no products, pricing, contact details, legal notices, forms or stated purpose, so its business model and intended audience cannot be determined from what it publishes. It may be a deployment that was removed or never completed, or a placeholder that could later be filled with different content.

Scam/Impersonation Risk

The site carries confirmed contradictions that call for a clearly cautionary stance. Several independent security engines, including a tier-one vendor, classify the domain as malicious, and this has produced a confirmed external blacklist hit. The error page itself shows no deceptive claims. The sandbox runs nonetheless recorded hidden form structures and password-form elements in every run, even though the visible page shows no forms. After interaction, the page also showed a very large burst of DOM changes and heavy external request activity. That pattern does not fit a static error screen and is consistent with content that is swapped or injected after load. A brand-similarity flag also fired because the name closely resembles the hosting platform's own, although no impersonation was confirmed. Two abuse reports exist, but they attach to a shared provider address and not to this site, so they are discounted. Operator identity remains unverified. No conflicting legal identities were observed, and no phishing was confirmed on the visible page. Evidence:

• Homepage: security engines recorded 5 malicious and 1 suspicious verdicts, including a tier-one vendor, and this triggered a confirmed blacklist hit.
• Homepage sandbox: 3 of 3 runs detected hidden forms and password-form elements, and the maximum DOM change after interaction was 4,130 mutations.
• Homepage sandbox: 36 external network requests were recorded, 15 of them XHR/fetch, none to non-whitelisted destinations.
• Hosting layer: 2 abuse reports were filed against a shared provider address, not this domain, and carry zero confidence.

Regulatory Verification Notes

The only page observed is a platform error screen. It carries no legal entity name, licence, registration number, terms, privacy policy or contact route, so there is nothing on the site to link it to an accountable operator. The business-model assessment found no financial offering and no licence claim, so no licensing verdict can be drawn. Independent broker-reputation databases hold no match for the site. The transport-encryption certificate belongs to the hosting platform and not to an independently verified operator, so it gives no assurance about who controls this deployment. Evidence:

• Homepage: no company name, licence, registration or legal pages were published.
• Transport encryption: the TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• Broker reputation: no match found in the reputation dataset.

What to Verify Next

No login, credential entry or payment should be attempted. The first step is to confirm independently, through a channel the site does not control, who operates this deployment and why it was shared with the user. Any link received by email, message or social media should be traced back to a sender whose identity is confirmed offline. The official address of any organisation this "portal" claims to represent should be checked directly against that organisation's known website and official contact channels. Further checks are needed on whether the content behind this address has changed, and whether a security team or the hosting platform's abuse desk has acted on the malicious classifications. Evidence:

• Homepage: the page offers no service claims that could be checked against a registry.
• Homepage: it shows no visible forms, yet sandbox runs detected concealed password-form elements.
• Threat intelligence: the confirmed blacklist hit makes independent confirmation of the sender's identity necessary before any interaction.

Summary Verdict

The overall posture is low trust with elevated risk. Convergent threat detections, a confirmed blacklist hit and concealed form behaviour outweigh the neutral appearance of the error page and the technically sound certificate. Operator identity is unverified, and the evidence does not support treating this address as a safe destination for sensitive activity.

Infrastructure Integrity

The site is served from Amazon-operated address space, behind a protective CDN/WAF layer that is a mitigating factor only. All four observed addresses are edge nodes, and no origin server could be observed, which limits independent hosting verification. The infrastructure is mainstream and not itself suspect, but it does not offset the reputation findings, and edge-only visibility can mask rapid content changes.

Closing Assessment

At most, the address should be viewed read-only from an isolated environment, with no credentials, wallet connections, personal data or payments submitted. Any message that directed a user here should be treated as unverified, and the matter should be reported to the organisation's security team.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.