Is portal-moonshot-5wb.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This web address is a subdomain on Netlify's shared hosting platform whose name suggests a "portal" for a "moonshot" project. When visited, it shows only Netlify's generic "Site not found" error page. That page has no branding, product description, contact details, or legal identity, and it ends with a prompt to build and deploy a site for free. No service or business model is visible. The address appears to be a placeholder or a deployment that is not currently live, and it carries a name that invites a visitor to expect a login or account portal.

Scam/Impersonation Risk

The analysis found confirmed adverse contradictions. Several independent security engines currently flag the address as malicious, including a major endpoint-security vendor classed among the most reliable detectors, and it also sits on an external blacklist. This is a confirmed blacklist hit, and it is the decisive factor behind the cautionary posture. The homepage content does not explain the detections. It is an inert error page and shows no phishing text, no wallet-connection prompts, and no clipboard or drainer behaviour. A page that is empty at the time of capture can still be a staging point for later content, because a hosted placeholder can be swapped for a different front end without notice. The address also closely resembles the hosting platform's own domain, and the analysis flagged it as a suspected lookalike. No legal-entity conflict was found. Two abuse reports exist against one of the platform's shared edge addresses. They apply to infrastructure used by many tenants and are discounted, so they are not attributed to this site. The browser sandbox also recorded concealed form elements in all three runs, including password-type fields, on a page that visibly contains no forms. It also recorded very large page-structure changes after interaction. These behaviours are inconsistent with a static error page and are consistent with credential-capture markup waiting to be shown. Evidence:

• Homepage: shows only the platform's generic "Site not found" message and an internal ID. It has no forms, links, social presence, or service description.
• Reputation checks: five engines rated the address malicious and one suspicious, and an external blacklist also lists it. The address is also outside the top one million sites by traffic rank.
• Browser sandbox, three of three runs: hidden forms and password-type inputs were present, and about 4,130 page mutations occurred after interaction.
• Domain provenance: subdomain first observed 2026-10-07 (~13 days old, ~0.04 years). The web archive holds 1 snapshot, so 1 year is tracked, and the address is not DeFiLlama-listed.

Regulatory Verification Notes

The site discloses no legal entity, operator name, registration number, licence, jurisdiction, terms, or privacy policy. It has no regulated-activity claims at all, so nothing is asserted that could be verified against a registry. The operator is therefore unidentified, and ownership is opaque. Independent identity checks found nothing to connect the address to a real-world brand or person. The visible valid certificate names the hosting platform as its subject, not the site's operator, so it confirms transport security only. No third-party broker or reputation dataset matched this address. The adverse reputation signal comes from the threat detections described above, not from any regulatory finding. Evidence:

• Homepage: no company name, address, legal pages, licence statement, or contact route.
• Transport encryption: OV certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19 (about 150 days remaining).
• Hosting: AS16509 (AMAZON-02, Amazon.com, Inc., US), registry ARIN, with four edge IPs observed.
• Broker intelligence: no match, so there is no third-party licensing or reputation record for this address.

What to Verify Next

Any claim that this address is an official portal should be checked through an independent route. That means the organisation's own known website or a printed or offline contact, not a link, message, or advertisement that pointed to this address. Where the address reached a user through a message, advert, or QR code, the sender and the campaign should be treated as unverified until the organisation confirms them directly. The address can be re-assessed if a live site appears. Any login, wallet, or payment prompt that later appears should be checked against the organisation's official domain. A hosting-platform abuse report for this address is a reasonable step for anyone who encountered it in a solicitation. Evidence:

• Homepage: no stated identity or official-channel information to cross-check, so independent confirmation is the only route.
• Domain age: the address was first observed 13 days before this assessment, which is too recent to have an established reputation.
• Naming: the subdomain wording ("portal") implies an account area that the live page does not provide.

Summary Verdict

The address is assessed as high risk with confirmed adverse reputation. Independent threat detections outweigh the few benign technical attributes it has, and they are not offset by any positive identity or legitimacy evidence. The site's apparent emptiness does not reduce that assessment. Its very recent creation, unidentified operator, and the hidden credential-style form behaviour observed make it a poor candidate for trust. The adverse detections are the decisive factor.

Infrastructure Integrity

The address sits behind Amazon-operated CDN/WAF edge infrastructure, and all four observed IPs are edge servers. The origin server was not observable. This arrangement offers protective hosting and a valid, correctly issued certificate, and these are mitigating technical factors only. Edge-only visibility also means the underlying content can be changed rapidly without any visible infrastructure change. Shared edge addresses are used by many tenants, so reputational signals on those addresses say little about this site. The infrastructure therefore cannot offset the confirmed threat detections.

Closing Assessment

The address should be treated as unsafe for any sensitive interaction. No login, credentials, personal data, wallet connection, or payment should be entered or submitted here. Passive viewing of the error page is the only low-risk use, and nothing should be downloaded. Anyone who has already entered credentials on a page at this address should change them promptly and monitor the affected accounts.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.