Is portal-moonshot-klu.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on the Netlify hosting platform that currently serves only the platform's stock "Site not found" 404 page. The page tells the visitor that a broken link was followed or that the address does not exist. It offers no services, products, navigation, or legal text, so no business model or purpose is visible. The address is styled like a portal ("portal-moonshot"), which suggests it may be a placeholder or a staging endpoint. It may also be a deployment that was removed or never published.

Scam/Impersonation Risk

Confirmed contradictions are present, and the site is blacklisted by external threat intelligence. Several independent detection engines classify the address as malicious, and one of them is a tier-one security vendor. This is the decisive finding and cannot be offset by the benign appearance of the landing page. The page itself shows no forms, links, or commercial content, but automated browser sessions behaved differently. Across all three sessions the site produced concealed forms that included password-type fields, and the page structure changed heavily after interaction. A visible error page that hides credential-capable forms behind it is a pattern consistent with a staged or switchable lure. The sessions also showed no cloaking, wallet-drainer, or clipboard-hijack behavior, and all external network calls went to recognised destinations, which limits the confirmed technical impact. A brand-similarity flag against the hosting platform's own namespace also fired. Because the domain is a legitimate platform subdomain, that flag carries limited weight on its own, but it adds to the pattern. Four abuse reports exist against an address in the shared cloud edge range used by this site. They apply to infrastructure shared with many unrelated tenants, so they say little about this specific site and are treated as secondary context. No conflicting legal identities were found, because the site publishes no identity content to compare. Evidence:

• Homepage (default 404 page): about 368 characters of platform boilerplate, with no contact, legal, or service content.
• Behavioral sessions: hidden forms were detected in 3 of 3 runs, with 3 password-type forms and roughly 4,130 DOM mutations after interaction.
• Threat-intelligence reputation: 5 engines flagged the domain as malicious (55 harmless, 32 undetected), including one tier-one vendor, and an additional external blacklist flag was set.
• Shared hosting address: 4 abuse reports on a content-delivery-network address, classified as shared infrastructure.

Regulatory Verification Notes

The site discloses no operator, company name, licence, registration number, jurisdiction, or terms of service. The visited page is a platform error screen with no legal or "about" content. The operator's real-world identity therefore remains independently unverified, and nothing on the site can be tested against a registry. No third-party broker or regulatory profile matched this domain. The valid certificate does not change this. It is an organisation-validated certificate issued to the hosting platform itself, so it attests to the platform's identity and not to whoever deployed this subdomain. Evidence:

• Homepage: no company name, licence, address, or policy documents are present.
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Third-party broker database: no match for this domain.

What to Verify Next

Any link to this address should be traced back to the party that supplied it and confirmed through an independent route, such as a known phone number or an official website typed in manually. If the sender claims a portal or account system at this address, the claim should be checked against that organisation's published domains. A reported malicious address should not be taken as the organisation's real portal because a certificate is valid or the page loads cleanly. If the address appeared in an email, message, or advertisement, the message itself should be treated as suspect and reported to the apparent sender's official security channel. A later re-scan is worthwhile if the site's content changes. Evidence:

• Homepage: no content identifies who deployed this subdomain or what it is meant to serve.
• Behavioral sessions: concealed password-type forms mean any later content change could turn the address into a credential-collection page.
• Reputation findings: the address is currently listed by several detection engines.

Summary Verdict

The assessment is a high-risk, clearly cautionary posture. Confirmed external blacklisting and concealed credential-capable forms outweigh the valid encryption and the stable, error-free behavior of the page. Because the site publishes no identity or purpose, nothing offsets these findings, and the operator's legitimacy cannot be established from the available evidence.

Infrastructure Integrity

The site runs behind an Amazon-operated CDN/WAF layer. All four observed addresses are edge servers, and no origin address was observable. Such protection is a mitigating factor only and does not offset the reputation findings. Edge-only visibility prevents independent verification of where the content actually originates, and it can mask rapid content swaps.

Closing Assessment

This address should be treated strictly as read-only. No login, credential entry, or payment should take place on it, and nothing should be downloaded from it. Anyone who received the link should leave the page and confirm its origin through an independent channel before any further interaction.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.