Is portal-moonshot-h5r.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This address is a subdomain on a shared hosting platform that currently serves only the platform's generic "Site not found" 404 error page. It shows no products, services, branding, or contact details. Its apparent purpose cannot be determined from the content. The page tells visitors the link is broken or the site is not deployed. Despite this empty presentation, the host is tied to adverse external threat detections, and the page runs concealed form and script activity that a plain error page would not have.

Scam/Impersonation Risk

Confirmed contradictory signals are present, and they come from external threat intelligence, not from the page's visible content. Several independent security engines flag this hostname as malicious, and at least one tier-one security vendor is among them. These detections produce a confirmed blacklist hit that the platform's own infrastructure cannot offset. The hostname also closely mimics the naming pattern of the hosting platform's own domain. That lookalike resemblance was noted, but it has not been confirmed as deliberate brand impersonation. No conflicting legal identities appear, because the page contains no identity content at all. Behavioral testing found three hidden forms in every run, and each contained password fields, although the visible page shows no login, form, or sign-in prompt. The page's structure also changed heavily after interaction. Such a gap between what is displayed and what is present is typical of a placeholder that can be repurposed into a credential-harvesting page. The sandbox found no outbound posts to non-whitelisted destinations, no wallet-connection or clipboard activity, and no cloaking, so no active data exfiltration was demonstrated. Two abuse reports exist against one of the platform's shared infrastructure addresses. They apply to a shared provider address, not to this site specifically, and were discounted. Evidence:

• Homepage: shows only a platform 404 "Site not found" message, with no business content, forms, or contact information visible to a visitor.
• Homepage behavior: hidden password-bearing forms detected in 3 of 3 sandbox runs, with roughly 4,130 page changes after interaction.
• External reputation: 6 security engines rate the hostname malicious, including one tier-one vendor, and the blacklist hit is confirmed.
• Hostname: its naming pattern closely resembles the hosting platform's own domain.

Regulatory Verification Notes

The page contains no legal, licensing, ownership, or registration disclosures, because it is a hosting error page and not a business page. No license is claimed, so there is nothing to confirm or refute. The operator's real-world identity is unverified, and the ownership picture remains opaque. This is an identity gap, not an identity contradiction. No third-party broker or regulatory-database entry matched this site, so no reputational context is available from that source. The only third-party signals on file are the external threat detections described above, and they are not a licensing or legal ruling. The site's transport encryption is valid, but it establishes only that the traffic is encrypted. The certificate belongs to the hosting platform, not to the operator of this subdomain, and so does not identify who runs the content. Evidence:

• Homepage: no company name, license number, terms, privacy policy, or contact page is present.
• Transport encryption: the OV certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).

What to Verify Next

Independent verification should start with the channel through which this address was received. This means confirming, through a trusted offline or previously known route, whether the sender actually intended to point to this hostname. Confirm whether an official site of the claimed organization exists under its own known domain, and compare it with this address. Check whether the hostname has begun serving login or payment content, since the hidden forms indicate the placeholder could change quickly. Confirm any official support or contact channels through the organization's established public presence, not through anything reached from this address. Evidence:

• Homepage: no destination, product, or organization is named, so the claimed sender's intent cannot be inferred from the page.
• Homepage behavior: hidden password forms and heavy post-interaction page changes show that the page's content is not fixed.
• External reputation: current threat detections mean any later content on this hostname starts from an adverse standing.

Summary Verdict

This is a high-risk, clearly cautionary assessment. The hostname is currently an empty placeholder, yet it carries confirmed adverse external detections and concealed credential-capable form behavior. The valid encryption and absence of observed data exfiltration do not outweigh these signals. The site's legitimacy and operator identity are unverified, and the available evidence does not support treating it as trustworthy.

Infrastructure Integrity

The hostname resolves to Amazon-hosted CDN edge addresses, and the actual origin server is not visible. The edge addresses and the hosting platform's valid certificate are mitigating factors only. They show that the content sits on mainstream, professionally operated infrastructure. They do not show who controls this subdomain and do not offset the external threat detections. Edge-only visibility also means content can be swapped quickly without any change to the hosting footprint.

Closing Assessment

Do not enter credentials, payment details, or personal data on this address, and do not download anything from it. Treat it as read-only at most, and reach the claimed organization only through independently confirmed channels.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.