Is portal-moonshot-9zg.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website address is a subdomain on the Netlify hosting platform. When captured, it served only Netlify's default "Site not found" error page, which says the visitor followed a broken link or entered a URL that does not exist. The page carries a platform reference identifier, a "Start building" prompt and no other content. It presents no products, offers, forms, navigation or stated operator, so no business model can be derived from it. The address pattern reads as a generic portal or staging-style label rather than a named brand.

Scam/Impersonation Risk

Contradictory signals are present, and they are the decisive factor in this assessment. Multiple independent security engines currently flag the address as malicious or suspicious, including a top-tier vendor, and this constitutes a confirmed blacklist listing. A lookalike heuristic also associated the address with the hosting platform's own brand, because the label mimics the platform's naming. This is a similarity indicator, not a confirmed impersonation. Behavioural testing found hidden forms and password-type fields in all three sandbox runs, plus very large DOM changes after interaction. The visible capture shows no forms at all, so the page presented to a casual visitor differs from the markup the browser actually loaded. That pattern is consistent with a placeholder that can be swapped for credential-collection content at short notice. No legal-entity conflict was observed. Two abuse reports exist against a shared provider address, but they are attributed to shared infrastructure and are discounted rather than treated as evidence against this site. No wallet-connection, clipboard-manipulation or fingerprinting behaviour was observed. Evidence:

• Homepage capture: a default platform 404 page with a 368-character body, no links, no forms and no stated operator.
• Reputation checks: several independent engines flag the address, including a top-tier vendor, so the blacklist listing is confirmed.
• Behavioural sandbox (3 of 3 runs): hidden forms and password-type fields detected, with about 4,130 DOM mutations after interaction, none of which appear in the visible capture.
• Two abuse reports against an Amazon-operated address were attributed to shared infrastructure and discounted.

Regulatory Verification Notes

The captured page contains no legal, terms, privacy, about or licensing content, so no disclosure of an operating entity, registration number or regulator exists to assess. The operator's real-world identity is unverified, and ownership is opaque. No licensing claim is made, and no third-party broker-database entry matches the address, so no regulatory status can be inferred in either direction. The transport-layer facts below are authentic but show only that the hosting platform's infrastructure is functioning. They say nothing about who controls the content. Evidence:

• Served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 at Organization Validation level, with the subject organisation listed as Netlify, Inc and validity to 2027-03-19.
• Homepage: no company name, licence, address or contact channel is published.
• No broker-reputation record matches the address.

What to Verify Next

Because the content cannot be assessed and the reputation signals are adverse, the address should be treated as unvetted. Anyone expecting to deal with a counterparty at this address should first obtain its URL through an independent, offline channel, such as a signed contract, an official brand directory or a known contact, and should confirm that the counterparty actually operates it. Whoever received the link should ask the sender to confirm it out of band. Official support or contact channels should be confirmed independently. If the site is the user's own, the deployment should be reviewed on the hosting platform for an unpublished or misconfigured project, and for any unauthorised content changes that could explain the hidden form behaviour. Evidence:

• Homepage capture: the platform reports that no site is published at this path, so there is nothing to validate against.
• The mismatch between the visible page and the hidden form markup found in the sandbox requires a content review before any further use.
• Reputation listings are current, so a fresh re-scan is needed after any remediation.

Summary Verdict

The assessment is clearly cautionary. Corroborated external threat detections, behavioural markup that contradicts the visible page, and an unverified operator together outweigh the technically valid transport security. The address cannot currently be regarded as safe for any sensitive interaction, and the unverified operator leaves the question of intent open.

Infrastructure Integrity

The address resolves through Amazon-operated infrastructure, and all four observed IP addresses are edge nodes of a recognised CDN/WAF. The origin server is not observable. The certificate is valid and issued under a mainstream authority, and the hosting is mainstream. This is a mitigating factor only: it shows that the platform is reputable. It does not show that the content or its controller is. Edge-only visibility also limits independent verification of what sits behind the address and allows content to be replaced quickly. This infrastructure does not offset the reputation risk.

Closing Assessment

The address should be used read-only at most. Credentials, logins, personal data and payments should not be entered or sent here, and nothing should be downloaded from it, until the external listings are cleared and the operator is independently identified.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.