Is portal-moonshot-esj.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Overview

This website is an unbranded subdomain on a public site-hosting platform whose homepage shows only the platform's default "Site not found" error page. It displays no company name, products, services or contact details, so it has no visible purpose or business model. The platform-style address pairs the word "portal" with a "moonshot" label, which suggests a login or access gateway that is not currently deployed at this location.

Scam/Impersonation Risk

Contradictory signals are present and are the decisive factor. Two independent threat-intelligence sources flag the domain as malicious and a third marks it suspicious, and the domain also sits on an external blacklist. The page analysis independently suspects brand impersonation, because the address closely resembles the hosting platform's own domain. Prior-history indicators also associate the domain with phishing. This pattern is typical of a throwaway staging or lure address built on a trusted platform's namespace. No conflicting legal entities appear, because the site names no entity at all. The visible page is a benign-looking error screen, but the behavioural analysis shows it does not behave like one. Three of three automated sessions detected hidden forms, including password-type fields, on a page that shows no visible form. After interaction, the page structure changed by more than four thousand DOM mutations, and the final destination did not match the requested one. A 404 page that carries concealed credential-capture elements and rewrites itself on interaction is consistent with a cloaked phishing kit that serves a decoy to scanners. Network behaviour was otherwise unremarkable: no wallet-connection, clipboard-hijack or fingerprinting activity was observed, and external requests went to whitelisted destinations. The address also shows ephemeral, fast-flux-like DNS behaviour, which suits rapid content swaps. Evidence:

• Homepage: a default hosting-platform 404 page ("Site not found") with no visible forms, links or commercial content.
• Homepage behaviour: hidden forms with password fields in all three sandbox runs, and a final-destination mismatch after interaction.
• Homepage structure: more than 4,000 DOM mutations after interaction, which is anomalous for a static error page.
• Domain name: the address closely resembles the hosting platform's own domain, and the page analysis flags suspected brand impersonation.

Regulatory Verification Notes

The site presents no legal, terms, privacy or about pages, so there is no corporate name, registration number, regulator reference or licence claim to assess. Ownership is opaque, and nothing on the site connects it to a real-world person or organisation, so operator identity remains unverified. Because the site offers no financial or regulated service, the absence of licensing is a transparency gap and not evidence of wrongdoing in itself. No third-party broker or regulatory-database match exists for this domain. The technical foundation is ordinary and does not offset the threat findings. The site has a valid organisation-validated certificate, but it belongs to the hosting platform, not to any operator of this address. It shows only that the platform's infrastructure is functioning. Evidence:

• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02 – Amazon.com, Inc., US).
• Site content: no licence, registration number or legal-entity disclosure anywhere on the captured page.

What to Verify Next

Treat the address as unverified and do not assume it belongs to any known service. Anyone who received this link in an email, message or QR code should confirm independently, through the organisation's published channels and not through the link, whether the organisation operates a portal at this address. A genuine service would normally use its own registered domain, not a generic subdomain on a hosting platform. The sender should be asked to confirm the origin of the link. Security teams should consider reporting the address to the hosting platform's abuse desk and checking mail and proxy logs for other users who have visited it. If any credentials were entered here, they should be changed immediately and multi-factor authentication reviewed. Evidence:

• Homepage: no brand, operator or official contact route is given that could be used to validate the address.
• Hidden form elements were detected on the page, so any credential entry here would go to an unknown destination.
• Threat-intelligence sources currently flag the domain, which supports escalating the report.

Summary Verdict

The available evidence supports an elevated-risk, clearly cautionary posture. Multiple independent threat detections, a confirmed blacklist listing, suspected platform-brand impersonation and concealed credential-capture behaviour converge on this domain. No credible legitimate identity or purpose is visible to counterbalance them. The site is best classed as a probable phishing staging or lure address, whatever its present blank appearance.

Infrastructure Integrity

The site is served from Amazon Web Services edge infrastructure (AS16509, US) behind the hosting platform's front end. All four observed addresses are edge nodes and the origin server was not observable. This protective layer is a mitigating factor only and cannot offset the reputational findings. Four abuse reports were recorded against one of the shared edge addresses. They apply to infrastructure shared with many tenants and not to this site specifically, so they carry limited weight on their own. Edge-only visibility prevents independent hosting verification and allows content to be swapped quickly without any change at the address. Evidence:

• Hosting infrastructure: four edge IP addresses, all in AS16509 (Amazon), with no origin candidate identified.
• Reputation data: four abuse reports on a shared edge address, attributed to shared infrastructure.

Closing Assessment

The address should not be used for login, credential entry, payments or any financial interaction. Any link that leads here should be treated as untrusted, and the page should be viewed only from an isolated environment, if at all. Reporting it to the hosting platform and to the organisation whose branding it may be borrowing is the appropriate response.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.