Is portal-moonshot-d37.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a Netlify-hosted subdomain with a generated "portal-moonshot" name. When captured, its homepage returned only a short "Site not found" error page, with no products, services, branding or stated business purpose. The address is consistent with a short-lived deployment on a shared hosting platform, and its commercial purpose cannot be established from what it presents.

Scam/Impersonation Risk

Contradictory signals are present and decisive. The address is blacklisted: several independent threat-intelligence engines flag it as malicious, including two top-tier security vendors, and an external blacklist confirms the listing. This listing alone forces the most severe trust classification. No conflicting legal identities and no explicit brand-impersonation or phishing-page finding were observed, because the captured page carries no brand or entity content. Sandbox testing of the homepage still found behaviour at odds with a bare error page: forms hidden from the visible interface were detected in every run, password-entry fields were present, almost all network activity went to external destinations, and the page structure changed heavily after interaction. A page showing "Site not found" should not contain concealed credential-capable forms. That fits a placeholder or a staged lure whose content is swapped in after deployment. The two abuse reports on the network address are attributed to shared provider infrastructure and are discounted, so they add no weight against this site. No wallet-connection, clipboard-hijacking or cloaking behaviour was seen. The site's own address therefore carries the risk, not its neighbours on the shared platform. Evidence:

• Homepage: capture returned an error response titled "Site not found" with only a few hundred characters of text, and no product or entity content.
• Homepage behaviour: concealed forms were observed in 3 of 3 sandbox runs, with password fields present and about 99.6% of network activity directed to external hosts.
• Homepage behaviour: roughly 4,130 page-structure changes were recorded after interaction.
• Domain provenance: the domain is about 19 days old (0.05 years), with 19 archive snapshots all in 2026 (1 year tracked, first and last seen 2026-10-02).

Regulatory Verification Notes

The captured homepage contains no legal, corporate, licensing or contact disclosures, so there is nothing on the site to assess. No operator can be tied to the site, and its real-world identity remains unverified. Ownership and governance are opaque, with no named entity, registration number or regulatory status. Because of the confirmed threat listings, this absence cannot be read as a neutral transparency gap. The valid, organisation-validated TLS certificate names the hosting platform as its subject, not the site's operator. It shows only that encrypted transport is configured, and it says nothing about who runs this site or whether it is legitimate. No third-party broker or regulator record was matched. Evidence:

• Homepage: no company name, licence, registration or legal-terms content is present.
• Transport encryption: certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

Verification should start with the threat listings, not with licensing. Re-check the address against current threat-intelligence sources to see whether the detections persist, since a fresh deployment may be re-scanned and re-rated. Anyone who received this link should confirm through an independent route, such as a known contact by phone or a published official channel, who sent it and what it was meant to reach. The legitimate operator, if any, should be identified from an official source outside this site before any dealings. Any claimed licence or registration should be checked directly with the relevant registry, not through links or details found here. Evidence:

• Threat listings: the detections by multiple engines are the main item to re-test, and the listing is active at the time of analysis.
• Homepage: it names no operator, so no entity can currently be checked against a registry.
• Identity: independent connection of the site to a real-world brand or person was not established.

Summary Verdict

The evidence supports a critical-risk, clearly cautionary posture. Confirmed malicious detections from several independent sources outweigh the technically sound transport configuration and stable page delivery. The site is also very new and shows no verifiable operator or established history. The concealed-form behaviour on an otherwise empty page reinforces the adverse assessment.

Infrastructure Integrity

The site sits behind Amazon-operated CDN/WAF infrastructure, and every observed address is an edge node. The origin server was not observable, which limits independent hosting verification and can mask rapid content swaps. The platform's protections are a mitigating factor only. They cannot offset the confirmed reputation risk, and shared-platform hosting is no evidence of legitimacy.

Closing Assessment

The site should be treated as unsafe for any sensitive interaction. Logging in, entering credentials or passwords, and making financial or payment transactions should be avoided entirely. Any contact with the address should be limited to non-interactive viewing from an isolated environment, and links to it should not be forwarded or acted upon.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.