Is portal-moonshot-frh.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at this address is a customer-hosted subdomain on the Netlify platform. When loaded, it serves only the platform's generic "Site not found" 404 error page. That page tells the visitor the requested path does not exist on Netlify and invites them to start building their own site. It shows no products, pricing, branding, forms, or business description, so its commercial purpose and monetization model cannot be determined from the visible content. The word "portal" in the hostname hints at an account or login destination, but the page itself makes no such claim.

Scam/Impersonation Risk

The assessment is clearly cautionary, and it rests on external threat intelligence, not on anything the page says. Several independent security engines currently flag the domain as malicious or suspicious, including one tier-one security vendor. This amounts to a confirmed blacklist presence and is the decisive factor. The visible page is inert, but automated behavioral testing across three separate runs repeatedly detected hidden forms containing password fields. These sit beneath a page that presents no login surface to a human visitor. That mismatch is typical of credential-collection staging, or of a deployment being swapped in behind a placeholder. It is reinforced by very heavy page-structure churn after interaction, which is unusual for a static error screen. A brand-similarity check also noted that the hostname closely resembles the hosting platform's own namespace. No brand impersonation, phishing page, or conflicting legal identities was confirmed, so this is a supporting concern, not a finding. Two abuse reports exist against one of the shared network addresses serving the site. They are discounted because that address belongs to shared provider infrastructure and says nothing specific about this site. Taken together, the blacklist presence and the concealed password forms make a rapid switch to a live credential-harvesting page a credible scenario.

Regulatory Verification Notes

The site publishes no legal, corporate, licensing, or contact pages. The only content is a platform error message, so there is no named operator, registration number, or regulator reference to assess. Operator identity is unverified, and ownership is opaque, so any claim that the site is a legitimate service would be unsupported. That is a disclosure gap, not evidence of wrongdoing by itself, but here it coincides with the threat detections described above. No third-party broker or regulatory-database match exists for this domain. The valid, organization-validated certificate belongs to the hosting platform and authenticates the platform, not whoever deployed this site. It therefore does not establish who operates the site.

What to Verify Next

Anyone who received this address through an email, text message, advertisement, or chat should confirm independently, through a channel not supplied by that message, whether the sender actually uses this host. Where an organization claims to operate here, its official website should be located through an independent search and the address compared against it. The address should also be re-checked later, because a placeholder can be replaced by a live page without notice. Anyone who encounters a login or payment form at this address should report it to the hosting platform. The error page carries a platform-issued internal identifier that lets the provider locate the specific deployment.

Summary Verdict

Available evidence places this website in a high-risk posture. External threat detections are decisive, and the very recent registration, unverified operator identity, and concealed password forms all point the same way. The benign appearance of the current page, and the platform's valid certificate, do not offset these signals. Legitimacy cannot be established, and the site should be treated as potentially hostile.

Infrastructure Integrity

The site is served from Amazon-operated infrastructure, and the observed addresses are all edge nodes of a trusted platform, with no origin server visible. This protective layer is a mitigating factor only: the abuse reports tied to the shared address are attributable to the provider, not to this site. Edge-only visibility also prevents independent verification of what sits behind the platform and allows content to be swapped quickly. It cannot offset the reputation risk.

Closing Assessment

Treat this address as read-only at most. No passwords, credentials, personal data, or payments should be entered, and nothing should be downloaded from it. Anyone asked to visit it should instead locate the organization's official website independently.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.