Is portal-moonshot-dfb.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a free, developer-oriented hosting platform, and it currently presents only that platform's generic "Site not found" error page. The page carries no products, company name, contact details or commercial offering. Its apparent purpose cannot be determined from what it shows: it may be an abandoned or unpublished deployment, or a placeholder for content swapped in later. The name suggests a user-facing "portal", and that name is the only pointer to what the site is meant to be.

Scam/Impersonation Risk

Contradictory signals are present, and they point to elevated risk. Several independent threat-intelligence engines flag the domain as malicious or suspicious, including a major security vendor. The domain is blacklisted by external reputation sources, and archive records carry a prior phishing association. Behavioral testing adds a mismatch between what the page shows and what it contains. The visible page is a bare error screen with no login function, yet all three sandbox runs found concealed forms, including password-entry forms, that a visitor would never see. The page also underwent a very large volume of DOM changes after interaction. A static error page has no legitimate need for this, and the pattern matches a placeholder that can be switched into a credential-harvesting front. The domain name also closely resembles the hosting platform's own brand, which raises a possible lookalike concern. Two abuse reports exist against a shared provider address used by this site. They were discounted as belonging to shared infrastructure and are not counted against the site. The blacklist and detection signals are not discounted. No conflicting legal entities were observed, because the page names no entity at all. Evidence:

• Homepage: the visible content is a hosting-platform 404 notice, but sandbox testing in all three runs detected hidden forms, including password forms.
• Homepage: very high post-interaction DOM mutation activity (about 4,130 changes) on a page with only a few hundred characters of visible text.
• Domain registration: the domain is only about 13 days old (registered October 2026), and the web archive holds 1 snapshot, in 2026 (1 year tracked).
• Reputation: the domain is flagged by multiple external engines and listed on an external blacklist. The two abuse reports on the shared provider address are attributed to shared infrastructure and discounted.

Regulatory Verification Notes

The page makes no licensing claim, names no operating company, and shows no registration number, address or legal documents, so no on-site disclosure can be assessed. The registration record is incomplete, which is ownership opacity and an administrative limitation, not an identity contradiction. The real-world operator has not been independently connected to any brand or person. The transport-encryption certificate is valid, but it is organization-validated for the hosting platform, not for whoever operates this subdomain. It confirms an encrypted connection and nothing about the site operator's legitimacy. No third-party broker or regulatory listing matched this domain. Evidence:

• Homepage: no company name, license, registration number or legal pages are shown.
• Transport encryption: the certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organization Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Third-party broker dataset: no match was found for this site.

What to Verify Next

Before any interaction, confirm independently with the hosting platform and the claimed operator that this subdomain is an intended, authorized deployment. If a link to this address was received in an email, message or advertisement, authenticate the sender through a separate, known channel. The sender should be able to explain why an unpublished site is being circulated. Any real brand referenced in connection with the address should be asked directly, through its official website typed in manually, whether it operates the portal. Official support and contact channels should be confirmed the same way. Evidence:

• Homepage: the page publishes no operator, brand or product to check against.
• Domain registration: the very recent creation (about 13 days) means no established reputation exists to rely on.
• Reputation: independent security feeds currently list the domain adversely.

Summary Verdict

The domain presents an elevated-risk posture. Active external detections and a blacklist listing, together with concealed credential-capable forms behind an empty error page, outweigh the valid encryption and the mainstream hosting provider. The site's real-world operator remains unidentified, and the apparent legitimacy that a clean site would earn is not supported here.

Infrastructure Integrity

The site is served from edge servers on Amazon's network (AS16509), behind the platform's CDN/WAF layer, and all four observed addresses are edge nodes. The origin server was not observable, which prevents independent verification of what actually hosts the content. This arrangement also allows content to be swapped quickly without any visible change in addressing. The hosting is mainstream and its protections are a mitigating factor only, and they do not offset the reputation risk.

Closing Assessment

The domain should be treated as unsafe for sign-in, credential entry or any financial interaction. At most it should be viewed passively in an isolated environment, and no files should be downloaded from it. Organizations should consider blocking or monitoring access until it is cleared or taken down, and reporting it to the hosting platform is reasonable.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.