Is portal-moonshot-ibt.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared hosting platform whose homepage currently serves only a generic "Site not found" error screen, stating that the requested address does not exist on that platform. The page offers a visitor no products, services, forms or contact details. The hostname ("portal-moonshot-ibt") suggests an intended login or customer-portal destination, but no business purpose or monetization model can be established from the content actually delivered.

Scam/Impersonation Risk

Confirmed contradictions are present, and they outweigh the harmless appearance of the page. Several independent security engines, including one major tier-one vendor, currently flag the domain as malicious or suspicious. This amounts to an external blacklisting. The visible content is an inert hosting error page, but behavioral testing found that the page does not behave like one. Across all three test runs, the page contained concealed forms, and password-entry fields were detected despite none being visible. Interacting with it also triggered an unusually large volume of page-structure changes, far beyond what a static 404 screen produces. Taken together with the hostname, this pattern is consistent with a credential-capture page that is displaying a decoy or deactivated front, or one that changes its content after interaction. The hostname also closely mimics the hosting platform's own naming and the portal-style branding it implies, and the content reinforces a brand-lookalike suspicion. No conflicting legal identities were observed. A small number of abuse reports exist against one of the platform's shared addresses. They are attributable to shared infrastructure rather than to this site specifically, so they add context but not independent weight. The decisive evidence is the blacklisting combined with the concealed credential-handling behavior. Evidence:

• Homepage: renders only a hosting-provider 404 "Site not found" message, with no visible forms, links or business description.
• Homepage behavior testing: concealed forms were detected in 3 of 3 runs, with password fields present and about 4,130 page-structure mutations after interaction.
• External reputation: multiple engines classify the domain as malicious or suspicious, including one tier-one vendor.
• Network: 4 abuse reports were recorded against a shared provider address and are attributed to shared infrastructure.

Regulatory Verification Notes

The site presents no legal, terms, privacy or about pages, so there is no corporate name, registration number, licensing claim or regulator reference to assess. No license was claimed and none could be verified. Ownership of the domain is opaque, and the real-world operator cannot be connected to any brand or person. That is an identity-verification limitation and is not an identity contradiction. A secure certificate is in place, but its organization field names the hosting platform and not the site's operator, so it does not establish who runs this site. No broker-reputation entry was matched. Evidence:

• Homepage: contains no legal-entity name, address, licensing statement or regulator reference.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, OV validation, subject organization Netlify, Inc, valid to 2027-03-19.
• Third-party broker reputation: no match.

What to Verify Next

Any contact with this address should first be checked against the organization that supposedly operates the portal. The expected login address should be obtained from that organization's official website, a printed statement, or a known phone number, and not from a link, message or search result that led here. If the hostname arrived via an email, text or advertisement, the sender should be confirmed through an independent channel. Administrators of any organization this address might impersonate should report it to the hosting platform's abuse desk and to their own security team. The domain should be re-checked later to see whether the external detections persist or the page content changes. Evidence:

• Homepage: no operator, brand or support channel is published that could serve as a verification anchor.
• Hostname: the portal-style naming implies a service that the page itself does not identify.
• External reputation: the detections are current, so the earlier assessment should be treated as live.

Summary Verdict

The overall posture is high-risk. The domain is blacklisted by external security sources, and its page behavior includes concealed credential-handling elements that contradict its inert appearance. The operator is unverified, and nothing on the site offsets these findings with legitimate substance.

Infrastructure Integrity

The site is hosted on Amazon-operated infrastructure, and the platform's content-delivery edge fronts all observed addresses. The true origin server could not be observed from the edge addresses alone. The valid certificate and reputable hosting provider are mitigating factors only. They show that the platform is sound, not that this tenant site is legitimate, and they cannot offset the reputation findings. Edge-only visibility also means the content served here can be swapped quickly without any visible change in hosting.

Closing Assessment

Treat this address as unsafe for any login, credential entry or financial interaction. No personal or payment information should be submitted. Access should be limited to passive viewing, and only if essential. Anyone who has already entered credentials here should change them immediately and enable multi-factor authentication where available.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.