Is portal-moonshot-bom.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on the Netlify hosting platform. Its homepage currently serves only the platform's generic "Site not found" error page, which says the visitor followed a broken link or entered a URL that does not exist and offers a troubleshooting guide and a prompt to start building a site. The page shows no products, services, pricing, contact details, or operator identity, so no business model is visible. The address uses the wording "portal" and "moonshot", which suggests an account or login gateway, but nothing on the page supports or explains that purpose.

Scam/Impersonation Risk

Contradictory signals are present, and they drive a cautionary assessment. Multiple independent threat-intelligence engines currently flag the address as malicious, including two major security vendors, and the address is confirmed as blacklisted. The domain is only a few weeks old, so this reputation damage accumulated almost immediately after creation. The visible 404 page does not fit that profile. In the behavioral sandbox, the page repeatedly built hidden forms, including password-type forms, across every run. It also produced thousands of structural page changes after interaction, which is far more than a static error page should generate. This suggests the error page may be a placeholder or a facade, with form-bearing content that is not visible on the surface. The hostname also closely resembles the hosting platform's own brand, and the page analysis flagged possible brand impersonation on that basis. No conflicting legal identities were observed, because the site names no legal entity at all. Separately, four abuse reports exist against a shared edge address of the hosting provider. They apply to shared infrastructure and are not attributed to this site specifically, so they are context rather than a standalone finding. Evidence:

• Domain registered 2026 (~14 days old); the web archive holds 1 snapshot, captured 2026-10-05, with 1 year tracked.
• Seven threat-intelligence engines classify the address as malicious, which establishes the blacklist hit.
• Hidden forms were detected in 3 of 3 sandbox runs (3 password forms recorded), against a homepage that visibly shows no forms.
• The homepage hostname closely mimics the hosting platform's brand, while the page content itself is the platform's stock error page.

Regulatory Verification Notes

The homepage contains no legal pages, company name, licence, registration number, or contact route. The site is therefore unverified as a real-world operator, and there is no regulated-entity claim to assess. The valid, organisation-validated certificate belongs to the hosting platform, not to whoever operates this subdomain. It confirms encrypted transport but says nothing about who runs the site. No third-party broker or regulatory-register warning matched this address, so the cautionary posture rests on technical threat detections, not on any licensing finding. Evidence:

• Served from AS16509 (AMAZON-02, Amazon.com, Inc., US), registered with ARIN.
• TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• The homepage shows no operator name, legal entity, licence, or policy pages.

What to Verify Next

Any interest in this address should first be tested against the platform's own account of what it hosts. Anyone who received this link should confirm through an independent, offline route with the supposed sender whether the sender actually published it. Anyone claiming to own the site should be able to explain why it serves a "not found" page while exhibiting hidden form behavior. The flagged address should be reported to the hosting platform's abuse channel, and security teams should block it pending a clean re-scan. Evidence:

• Hidden, password-type forms appeared in every sandbox run, though the visible page contains no forms.
• The address is flagged malicious by multiple engines despite its minimal visible content.
• The homepage offers no company, support, or contact channel to confirm the operator.

Summary Verdict

The site reads as a low-trust, elevated-risk property. Confirmed blacklisting, a very recent domain with almost no history, brand-lookalike naming, and concealed form behavior outweigh the technically valid certificate and mainstream hosting. The visible content is empty, and the hidden activity is the main concern.

Infrastructure Integrity

The site sits behind the hosting provider's CDN/WAF layer, and all four observed addresses are edge servers, so the origin server is not observable. That protection is a mild mitigating factor only. It does not confirm who operates the site, and the shared edge can mask rapid content swaps. It also cannot offset the external threat detections.

Closing Assessment

The address should be treated as read-only at most. No login, credential entry, or financial interaction should occur on it, and any link pointing to it should be handled as potentially malicious until the detections clear and the operator is independently identified.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.