Is portal-moonshot-l7t.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The site is a subdomain on a shared website-hosting platform that currently serves only the platform's default "Site not found" error page. The page has no business content, branding, offers, forms or contact details, so it has no apparent purpose or business model. The hostname, which reads like a "portal" for a project called "moonshot", suggests a deployment that was meant to carry a login or account portal but is not presenting one to ordinary visitors.

Scam/Impersonation Risk

Contradictory signals are present, and they support a clearly cautionary assessment. The domain is blacklisted by several independent threat-intelligence engines, including a tier-one security vendor, which is a confirmed reputational contradiction. The page analysis also flags the hostname as a strong lookalike of the hosting platform's own brand. This is a similarity signal, not proof of impersonation, because the visible page is the platform's genuine default error screen and no legal-identity conflict exists. The behavioural evidence deserves more weight than the visible page. Across all three automated visits the site contained hidden forms, including password-type fields, even though the rendered page shows nothing to log into. After interaction the page also rebuilt its content on a large scale, which is atypical for a static error page. This pattern is consistent with a credential-harvesting shell that shows a benign placeholder until a specific path or visitor condition is met. The behaviour is not confirmed phishing, since no outbound credential submission to an untrusted destination was observed. Four abuse reports exist for an edge address in the same hosting range, but they apply to shared provider infrastructure and are not attributed to this site specifically. They are therefore context, not independent proof. No conflicting legal identities appear, because the site discloses no identity at all. Evidence:

• Homepage: shows only the hosting platform's default "Site not found" notice with no products, claims, forms or contact details.
• Homepage behaviour: hidden forms were detected in 3 of 3 sandbox runs, with 3 password-type fields recorded, although no login form is visible.
• Homepage behaviour: roughly 4,130 page-structure mutations followed interaction, and external network activity accounted for nearly all requests.
• Reputation: multiple threat-intelligence engines classify the domain as malicious or suspicious, and the hostname closely resembles the hosting platform's own brand.

Regulatory Verification Notes

No licence, registration number, company name or legal page appears on the site, and there is nothing to assess because the only page is a platform error screen. The site cannot be tied to any real-world operator, so identity remains unverified and its legitimacy cannot be inferred from on-site claims. No third-party broker or regulatory-database entry matched the domain. The transport certificate is valid and organisation-validated, but it is issued to the hosting platform itself and so says nothing about whoever controls this subdomain. Evidence:

• Homepage: no operator name, licence reference, terms, privacy policy or contact page is present.
• Transport encryption: the TLS certificate is issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), with subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• Broker reputation: no matching entry was found in the third-party broker dataset.

What to Verify Next

Any organisation that sent this link or presented this portal should confirm through an independent, offline route that it controls this exact hostname. Official portal addresses should be taken only from the organisation's primary website or from printed or contractual material, not from the message that supplied this link. If the link arrived by email, SMS or social media, the originating message should be examined for spoofing and reported to the sender's security team. Site owners who recognise the project name should check their hosting account for unauthorised deployments, since a compromised or hijacked deployment would fit the hidden-form behaviour. Evidence:

• Homepage: no identifying information is published, so confirmation must come from outside the site.
• Hostname: the "portal-moonshot" naming and the platform lookalike similarity cannot be matched to any identifiable organisation.
• Hidden forms: the hidden password-type fields on a page that shows no login indicate that some alternate content path may exist.

Summary Verdict

The assessment is critical and high-risk. Confirmed external blacklisting, hidden credential-capable forms and unusual page behaviour together outweigh the technically sound transport security, which is routine for a hosting platform. Nothing connects the site to a verifiable operator. It is unsuitable for any sensitive or transactional interaction.

Infrastructure Integrity

The site is delivered through a major cloud provider's CDN and WAF, and every observed address is an edge node, so no origin server is visible. This is a mitigating factor only. Edge-only visibility prevents independent confirmation of where the content is actually hosted, and it can mask rapid content swaps. Protective infrastructure cannot offset the reputational detections.

Closing Assessment

The site should not be used for login, credential entry, payments or any financial action. At most it can be viewed passively, and no data should be submitted. Anyone who received a link to it should treat that link as suspect and report it to the organisation it appeared to represent.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.