Is portal-moonshot-jk0.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a newly observed subdomain on a shared site-hosting platform. Its root page shows only the platform's generic "Site not found" 404 notice, with an invitation to "Start building". It has no products, services, forms, legal pages, contact details or other published content. The hostname's "portal" and "moonshot" wording suggests a login or access gateway, so the address is likely meant to be reached through a link sent by a third party. No business model is visible.

Scam/Impersonation Risk

Hard contradictory signals are present. The hostname is blacklisted by external threat intelligence: several security engines, including a leading endpoint-security vendor, classify it as malicious or suspicious. The detections apply to the site's own hostname, not just to its shared infrastructure. The page also triggers a suspected-brand flag because the hostname closely resembles the hosting platform's own name. That is a lookalike indicator only. No explicit impersonation of a named brand, no phishing page and no conflicting legal identities were observed. The visible content is a generic error page. The behavioural evidence is what stands out. Hidden forms were detected in every sandbox run, and password-type form elements were present even though nothing visible is rendered. The page also generated more than 4,000 DOM mutations after interaction, far more than a static 404 should produce. It made dozens of external requests, including about twenty outbound POSTs and a number of XHR calls, but none went to non-whitelisted destinations. The domain resolves with a very low TTL and fast-flux-like characteristics. A dormant placeholder carrying concealed credential-capture markup, dynamic DOM behaviour and external blacklist hits is consistent with staged or cloaked phishing infrastructure waiting to be activated, or with a compromised or abandoned deployment. Cloaking was not detected during testing, so this remains an inference from the combination of signals and not a confirmed phishing finding. Evidence:

• Behavioural testing (three of three runs, homepage): hidden forms and password-type form elements were present on a page with no visible forms.
• Homepage: about 4,130 DOM mutations after interaction, plus 34 external network requests (14 XHR/fetch, 20 POSTs) on a 404 page.
• Domain provenance: first observed 2026-10-07 (about 13 days old, ~0.04 years), with a single archive snapshot and 1 year tracked.
• Threat-intelligence aggregation: 5 malicious and 1 suspicious detections, with one top-tier vendor flagging the hostname.

Regulatory Verification Notes

The site makes no regulatory, licensing or registration claims and publishes no legal, terms, privacy, about or contact pages. No operator name, company, jurisdiction or support channel appears anywhere on the site, so independent identity verification is not possible. The content gap is total, and it leaves nothing to corroborate the apparent purpose of the address. No third-party broker or regulatory-registry match was found, so no external reputational or licensing signal exists either way. The transport encryption does not help identify the operator. The certificate is organisation-validated, but it is issued to the hosting platform and not to the site's operator. It shows that the platform's shared edge is encrypted. It says nothing about who controls this subdomain. Evidence:

• Homepage: the page offers no company name, licence number, jurisdiction, policy pages or contact information.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.

What to Verify Next

Anyone who received this address by email, message or advertisement should treat the sender's claim as unverified. They should confirm the sender and the intended destination through an independent, previously trusted route, such as a known official website typed in directly or a call to a number from an official source. Any legitimate organisation should be able to supply its canonical domain. Users should not enter credentials, payment details or wallet information here. Passwords entered into this address should be considered exposed and changed. If the link arrived unsolicited or claimed to be from a service the recipient uses, it should be reported to that service and to the hosting platform's abuse channel. Security teams may monitor the hostname for content changes, because the placeholder could be replaced at any time. Evidence:

• Homepage: the root path returns a 404 "Site not found" notice that includes a platform-internal reference ID, which can be quoted when reporting to the hosting platform.
• Page type: the capture shows no navigation, links or social presence, so no on-site route exists for confirming the operator's identity.

Summary Verdict

Available evidence supports a clearly high-risk posture. External threat intelligence and anomalous behavioural indicators converge on a site that has no verifiable operator and no published content to offset them. The deterministic assessment is the lowest trust tier, and the site should be regarded as unsafe for any sensitive interaction.

Infrastructure Integrity

The site is served from addresses in Amazon's cloud network, behind the hosting platform's CDN/WAF layer. All four observed addresses are edge servers, and the origin is not observable. This is a mitigating factor only and does not establish legitimacy, because the same shared edge serves many unrelated sites. Two abuse reports on one of the edge addresses are attributed to the shared provider infrastructure and are discounted. They are not counted against this specific site. Edge-only visibility also means content can be swapped quickly without any change in apparent hosting.

Closing Assessment

Interaction beyond passive viewing should be avoided. No login, credential entry, payment or wallet connection should occur at this address, and nothing should be downloaded from it. Any request that directed a person here should be handled as potentially hostile and escalated to the relevant security or fraud team.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.