Is portal-moonshot-88a.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a bare hosting-platform "Site not found" error page served from a free-tier Netlify subdomain with a generated, portal-style name. The page contains no business content, products, pricing, forms, links or scripts, and it states that the requested address does not exist on the platform. No purpose or monetization model is visible, so the site's function cannot be established from what it presents. The "portal" naming pattern suggests the address is meant to front a login or access experience that is not currently being served.

Scam/Impersonation Risk

Contradictory signals are present and carry decisive weight. Several security vendors currently flag the domain as malicious, including two tier-one vendors, and this amounts to a confirmed blacklisting. The page analysis also found a strong lookalike relationship between the site's name and the hosting platform's own brand. Active impersonation was not confirmed, and the visible content is the platform's generic error text. The behavioural picture conflicts with that blank page. Across all three sandbox runs, hidden forms were detected, including password-type fields. The page also produced a very large volume of DOM changes after interaction and a heavy share of requests to external destinations. A static 404 should do none of this. The pattern is consistent with content that is swapped in or revealed conditionally, a common trait of credential-harvesting staging pages. All external posts and XHR traffic went to whitelisted destinations, and no wallet-drainer, clipboard-hijack or cloaking behaviour was seen. Abuse reports exist against a shared provider address used by this site's hosting. They are attributed to shared infrastructure and are not evidence against the site operator. The domain is also extremely young and shows almost no archival footprint, which removes any track record that could offset these signals. Evidence:

• Homepage: the captured page is the platform's "Site not found" error. It has no forms, links or scripts, yet the sandbox detected hidden forms and password-type fields in every run.
• Homepage behaviour: roughly 4,100 DOM mutations after interaction, and about 36 external network events, none to non-whitelisted destinations.
• Domain provenance: about 15 days of observed history (first seen 2026-10-04), with 1 archive snapshot across 1 year tracked.
• Reputation: multiple security vendors flag the domain as malicious, and two tier-one vendors are among them. Four abuse reports exist against a shared provider IP and are attributed to shared infrastructure.

Regulatory Verification Notes

The site presents no legal, terms, privacy or about pages. It names no operating company and cites no licence or registration. Ownership and governance are opaque, and the real-world operator cannot be independently connected to any brand or person. No third-party broker or regulatory-database entry corresponds to the site, so there is no reputational context to weigh. The only identity-related artifact is the transport-encryption certificate. It is an organisation-validated certificate issued to the hosting platform, so it attests to the platform's identity and not to whoever controls this subdomain. It confirms an encrypted connection and nothing about the operator. Evidence:

• Homepage: no company name, licence, registration number, address or contact details appear on the captured page.
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).

What to Verify Next

Any interaction should be preceded by establishing what this address is meant to be and who issued it. If it arrived through an email, message or advertisement, the sender and that route should be treated as the primary object of suspicion. The intended service's official portal address should be obtained independently, through an offline or previously trusted route, and compared with this one. The platform's own abuse channel is the appropriate place to report the address if it was received unsolicited. Re-examination is worthwhile only if the address later serves real content, in which case its identity, legal and licensing pages should be reviewed afresh. Evidence:

• Homepage: the page offers no way to confirm the operator or the intended service.
• Platform subdomain: the address is a free-tier subdomain with a generated name, which gives no inherent link to any established organisation.
• Sandbox behaviour: the hidden password-type fields mean any later content on this address should be treated as a potential credential-capture surface.

Summary Verdict

The overall posture is clearly cautionary. Confirmed third-party detections, concealed form behaviour inconsistent with the visible page, and an unverified operator on a very new, thinly documented domain together outweigh the technically sound encryption and platform hosting. The available evidence does not support treating this address as a legitimate service.

Infrastructure Integrity

The site is hosted on Amazon's network behind a trusted edge layer, and all four observed addresses are edge servers. The origin server was not observable, so hosting cannot be independently verified and content can be changed quickly without any visible trace. This protective infrastructure is a mitigating factor for availability and encryption only. It does not offset the external threat detections and says nothing about the legitimacy of the operator.

Closing Assessment

No login, credential entry, personal data submission or payment should take place on this address. If it was reached through an unsolicited link, it should be closed and the source reported, and any service it claims to represent should be reached only through an independently obtained official address.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.