Is portal-moonshot-5ay.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a default "Site not found" error page served by a hosting platform on a free, platform-assigned subdomain. It shows a short notice that the visitor followed a broken link or entered a URL that does not exist, a troubleshooting-guide pointer, and a prompt to "Start building" a new site. It offers no products, pricing, company information, legal pages or services, and no monetization model is observable. The address mimics the hosting platform's own naming and carries a portal-style label, so it behaves like a freshly created or abandoned placeholder rather than a business presence.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and the posture is clearly cautionary. Multiple independent threat-intelligence sources currently flag the domain as malicious, including one top-tier security vendor. This amounts to a confirmed blacklist hit that infrastructure protections cannot offset. The page analysis also flags the site as a strong lookalike of the hosting platform's own brand, so it may be borrowing that brand's credibility. The visible page is inert, but behavioral testing contradicts that. In all three sandbox runs, hidden forms were detected, including password-type fields, and the page showed very heavy DOM mutation (thousands of changes) after interaction. A 404 placeholder should contain no forms at all, and this pattern is consistent with a page that can swap in credential-collection content once a target path or lure is activated. Reports of abusive activity against the shared edge address are noted but belong to the platform's shared infrastructure, so they are weak, secondary context. No conflicting legal identities and no confirmed phishing-page content were observed on the page itself, and no contact email was published. Evidence:

• Homepage: a platform "Site not found" 404 notice with no service content, legal identity, contact details or policies.
• Homepage sandbox: hidden forms (including password fields) were detected in 3 of 3 runs, with about 4,130 DOM mutations after interaction.
• Domain provenance: registered 2026 (~13 days old); 1 archive snapshot, 2026 only (1 year tracked).
• Reputation: 4 malicious detections from external scanners, including one top-tier vendor, plus a confirmed external blacklist hit.

Regulatory Verification Notes

The site makes no licensing, registration or regulatory claim. It publishes no terms, privacy policy, about page or company name, so no operator is identified and no entity can be connected to the domain. Independent identity verification has not been achieved. This is a disclosure gap, but the verdict rests on the threat detections and the hidden-form behavior, not on missing paperwork. No third-party broker or regulatory-database record matched the domain, so no external reputational context exists on that front. The platform-issued certificate shows the hosting provider as subject organization, which confirms only the platform and says nothing about whoever controls this subdomain. Evidence:

• Homepage: no company name, jurisdiction, license number or legal documents are published.
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject Netlify, Inc, valid to 2027-03-19.
• Page metadata: no title, description or structured data beyond the generic error notice.

What to Verify Next

Do not treat the page as an operator-controlled site. Anyone who received this address in a message, advertisement or QR code should trace it back to its source. They should confirm through an independent, offline or officially published channel whether the sender actually intended to point to a hosted site. If a specific brand or service is claimed, its official domain should be retrieved directly from that organization's own materials rather than from this link. Any claim of authorization should be checked against the relevant registry only after a named entity is established. Official support and contact channels should be confirmed independently. Domain registration can be re-checked later to see whether real content ever replaces the placeholder. Evidence:

• Homepage: nothing on the page identifies a sender, brand or intended destination.
• Domain provenance: a domain only days old with a single archive capture offers no history to cross-check.
• Sandbox behavior: forms hidden on an otherwise empty page indicate that content could change after the visit.

Summary Verdict

The domain reads as a high-risk, unverified asset. Active threat-intelligence detections combine with brand-lookalike naming, a very recent creation date and anomalous hidden-form behavior. Its inert appearance does not reduce the assessed risk, and the overall posture is elevated and cautionary.

Infrastructure Integrity

The site is delivered through Amazon-operated edge infrastructure (AS16509, AMAZON-02, US registry ARIN), and all four observed addresses are edge nodes. The origin server could not be observed, so independent hosting verification is not possible and content could be swapped without notice. The certificate is valid and organization-validated, with a long remaining validity. These are mitigating factors only. Shared, reputable infrastructure does not offset the active threat detections or prove that the subdomain's operator is legitimate.

Closing Assessment

Interaction should be limited to passive, read-only viewing at most. Credentials, passwords, payment details and any financial action should be withheld, and nothing should be downloaded. Anyone who has already entered information on this address should change affected passwords and report the link to the platform's abuse team.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.