Is portal-moonshot-gc5.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared application-hosting platform that currently serves only the platform's generic "Site not found" 404 notice. It offers no product, service, content, or branding of its own. The only call to action is the host's own invitation to "Build and deploy your own site for free". Nothing on the page shows a business model or purpose, and its name suggests a staging or customer-portal deployment that is no longer, or not yet, populated.

Scam/Impersonation Risk

This site carries an elevated risk assessment, driven by external reputation and runtime behaviour rather than by anything written on the page. The domain is blacklisted: several independent threat-intelligence engines flag it as malicious or suspicious, including a tier-one security vendor. That is a confirmed contradiction with the benign appearance of a plain 404 page. The sandbox also observed behaviour that a static error page should not show. Hidden forms, including password-type fields, appeared in every observation run. The page changed heavily in structure after interaction, and almost all network activity went to external destinations. The final destination also differed from the requested one. A visible page with no forms, combined with concealed credential-capable elements, is a pattern consistent with a deployment that swaps content after the initial load. The domain name closely resembles the hosting provider's own brand domain. The visible text appears to be the provider's genuine error notice, so no impersonation of a specific brand is confirmed. Two abuse reports were recorded, but they attach to a shared edge address used by many tenants. They are discounted and are not attributed to this site. Evidence:

• Homepage: renders only a "Site not found" notice with an internal reference ID, and shows no visible forms, login, or purchase flow.
• Sandbox runs: hidden forms with password fields were detected in all three runs, and about 4,000 DOM mutations followed interaction on a page of roughly 370 characters of text.
• Threat intelligence: at least three engines rate the domain malicious and one more rates it suspicious, with a tier-one vendor among those flagging it.
• Network behaviour: external requests dominated traffic, and the final destination did not match the requested one.

Regulatory Verification Notes

The page carries no legal entity name, licence or registration reference, terms, privacy policy, or contact channel. It is a hosting placeholder, so these are not omissions by a real operator, and the real-world operator cannot be identified from any on-site content. The site claims no regulated activity, so there is no licence to verify. The absence of disclosure therefore does not itself indicate wrongdoing. It does mean nothing on the site can offset the reputation findings above. The transport encryption is technically sound but says nothing about who controls the content. The certificate is organisation-validated, but it was issued to the hosting platform, not to any operator of this subdomain. No broker-reputation record matches this domain. Evidence:

• Homepage: no company name, registration number, licence claim, or legal pages are present.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport security: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.

What to Verify Next

Verification should start with who commissioned and controls this deployment. Anyone who received this address in an email, message, or invitation should confirm with the sender, through a channel known independently of that message, that it is genuine. If the address was presented as a login or customer portal, the organisation's official website should be reached by typing its known address directly, and the portal link there compared. The hosting platform's abuse process can be asked whether the deployment is active, claimed, or flagged. Any organisation named in the original message should be asked to confirm that this address belongs to it. Evidence:

• Homepage: the only reference is the platform's own internal deployment ID, which the platform can use to look up the tenant.
• Sandbox runs: concealed password-type fields on a page with no visible login indicate that the content served can differ from what is displayed.

Summary Verdict

The available evidence supports a clearly cautionary posture. The site's identity is unverified, and a confirmed multi-source reputation hit coincides with concealed credential-capable elements and unstable runtime behaviour. Technical hygiene and the neutral appearance of the visible page do not outweigh these contradictions. The site is not suitable for any sensitive interaction.

Infrastructure Integrity

The site sits behind an AWS-based CDN/WAF, and every observed address is an edge node. The origin server was not observable, so the hosting cannot be verified independently, and content can be swapped behind the edge without a visible change in network identity. The protective layer is a mitigating factor only. It does not offset the external threat detections or establish legitimacy.

Closing Assessment

Do not log in, enter credentials, make payments, or share personal or financial data on this address. Passive viewing carries limited risk. Any message that pointed here should be treated as unconfirmed until the supposed sender verifies it by an independent route.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.