Is portal-moonshot-74u.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The site is a subdomain on a public application-hosting platform. At the time of analysis it served only that platform's generic "Site not found" error page. The page offers no products, services, pricing, account functions, contact details or company information, and no business model is visible. The subdomain name suggests a "portal", but the page itself offers nothing.

Scam/Impersonation Risk

Contradictory signals are present and are the decisive factor in this assessment. Several major security vendors currently flag the address as malicious, and the combined detections are enough that it is treated as blacklisted by external reputation sources. This is a confirmed blacklist-level concern, not a soft reputational hint. A separate set of abuse reports exists against one of the network addresses serving the site. Those reports apply to a shared provider address used by many tenants, so they cannot be attributed to the site's operator and carry less weight than the vendor detections. The hostname closely resembles the hosting platform's own domain. That resemblance is a lookalike signal and not confirmed impersonation, and no phishing or conflicting-identity finding is confirmed. The most concerning behavioural finding is on the homepage, which is only an error page with no legitimate reason to carry form machinery. Automated browsing found concealed forms containing password fields in every run. The page also showed very large structural changes after interaction, which a static 404 page should not produce. That pattern is consistent with content or credential-capture components being loaded dynamically behind a benign-looking front. It points to cloaking-style behaviour, but no wallet-drainer, clipboard-hijack or fingerprinting activity was observed. The 404 content itself looks harmless and the page does not host any visible scam, which is why the verdict rests on external detections and hidden form behaviour and not on visible deception. Evidence:

• Homepage: the visible content is only a hosting-platform "Site not found" notice with no services, claims or contact channels.
• Homepage behaviour: concealed forms with password fields were detected in all three automated runs, with roughly 4,130 page-structure mutations after interaction.
• External reputation: 10 security engines rated the site malicious and 1 suspicious. Three tier-one vendors (Fortinet, Kaspersky and Sophos) are among the flagging vendors.
• Network: 4 abuse reports were logged against a shared provider address, which is attributed to shared infrastructure and not to the site operator.

Regulatory Verification Notes

The site makes no licensing or registration claim, and the page carries no legal, terms, privacy or about content that could name an operating entity. No operator can be tied to the site, so identity remains unverified and ownership and governance are opaque. Legitimacy cannot be inferred from the page. The valid transport-encryption certificate belongs to the hosting platform, not to the operator, so it says nothing about who runs this site. No third-party broker or regulatory-database match exists for the site, and no regulator has been shown to oversee it. These are verification gaps and not independent proof of wrongdoing. The elevated assessment rests on the contradictory signals described above. Evidence:

• Homepage: no company name, licence, registration number or jurisdiction is stated.
• TLS: organisation-validated certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19, which identifies the platform and not the site operator.
• Third-party context: no broker-reputation match was found, so no external regulatory signal is available either way.

What to Verify Next

Any party considering engagement should first obtain the intended destination from an independent, trusted source, such as a direct written or offline contact with the claimed organisation. They should then confirm whether that organisation actually operates this hostname. If a link to this address was received through an unsolicited message, advertisement or social-media channel, the sender's identity should be checked separately. Official support or contact channels for the organisation should also be confirmed offline. If the hostname was supposed to host a legitimate application, its owner should confirm it was deployed deliberately and has not been tampered with, abandoned or reassigned. Evidence:

• Homepage: the page names no organisation, so the claimed operator must be established externally.
• Homepage: the platform's own message says the requested path does not exist, which suggests a broken, removed or misdirected deployment.
• Hostname: the "portal" naming pattern implies a login or access function that the page does not present.

Summary Verdict

The available evidence supports a clearly high-risk posture. Confirmed external threat detections, together with concealed credential-type forms and unusual page behaviour on an otherwise empty page, outweigh the neutral, content-free appearance of the visible page. The operator's identity is unverified, and nothing on the site offsets these findings.

Infrastructure Integrity

The site sits behind AWS-based delivery infrastructure (AS16509, Amazon), with all four observed addresses being provider edge addresses in the US. The real origin server could not be observed, so independent hosting verification is not possible. This arrangement can also allow content to be swapped quickly without visible change at the address level. The transport-encryption certificate is valid, organisation-validated and from a recognised issuer. These are mitigating factors only and do not offset the reputation findings. Evidence:

• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US) under the ARIN registry.
• Edge addresses: four observed, including 35.157.26.135 and 63.176.8.218, with no likely origin address identified.
• TLS: DigiCert Global G2 TLS RSA SHA256 2020 CA1, organisation validation, valid to 2027-03-19 (149 days remaining at analysis).

Closing Assessment

Account login, credential entry, payment and any financial interaction with this address should be avoided. Nothing should be downloaded or submitted through it. At most, read-only viewing is acceptable, and only from an isolated environment. If the address arrived through an unsolicited message, it should be reported to the relevant platform or security team.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.