Is portal-moonshot-lv3.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared static-hosting platform (Netlify's free-subdomain service). Its name suggests a "portal" or "moonshot" product. When captured, the homepage showed only a short "Site not found" message, with no brand, product, service description, or business model. Its purpose cannot be established from the visible content, and the real-world operator is not identified.

Scam/Impersonation Risk

Contradictory signals are present, and this section carries the report's principal concern. Multiple independent threat-intelligence sources flag the domain as malicious or suspicious, including at least one tier-one security vendor, which amounts to a confirmed blacklist listing. Reputation data also shows the domain was previously associated with known phishing activity. Behavioural testing adds to this. Across every automated run, the page contained concealed forms and password-entry fields even though the visible page said only that the site was not found. It also rewrote large parts of its own page structure after interaction, and almost all of its network traffic went to third-party hosts. The mismatch between a blank "not found" front and concealed credential-capture elements is a pattern typical of staged phishing kits, parked lures, or content swapped in after review. The traffic went to recognised services rather than unknown destinations, but this does not offset the other findings. Abuse reports on file relate to a shared provider address rather than to this domain specifically, so they are corroborating context only. No impersonation of a named brand or conflicting legal identities were observed, but the blacklist listing and the concealed-form behaviour justify a high-risk posture on their own. Evidence:

• Homepage: the captured page returned a "Site not found" response with only a few hundred characters of text, offering no product, company, or contact information.
• Homepage behavioural runs: concealed forms and password fields appeared in all 3 of 3 sandbox runs, and about 4,130 page-structure mutations followed interaction.
• Reputation checks: 6 engines rated the domain malicious and 1 suspicious, including a tier-one vendor, and the domain carries a prior phishing association.
• Hosting infrastructure: 4 abuse reports exist against an edge address in the shared hosting range, attributed to shared infrastructure and not undiscounted-confirmed against this domain alone.

Regulatory Verification Notes

The captured page contains no legal, terms, privacy, or about content, so no licensing status, registered entity, or accountable operator can be assessed from the site. The ownership and governance picture is opaque, and that opacity is itself an obstacle to accountability. It is a disclosure and transparency matter, separate from the reputation findings above, and it is not by itself evidence of fraud. No third-party broker or regulator record matches this domain, so no external reputational context exists on this axis. The only technical identity artefact is the transport certificate. It is an organisation-validated certificate issued to the hosting platform, not to the site's operator, so it confirms encrypted transport and the platform's identity. It says nothing about who runs this specific site. Evidence:

• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US), registry ARIN.
• Homepage: no company name, registration number, licence reference, or contact channel appears on the captured page.

What to Verify Next

Verify nothing through this site's own pages. Anyone who was given this address in an email, message, advertisement, or document should establish through an independent, offline route (a known telephone number, an in-person contact, or a separately sourced official website) whether the sender actually operates it. Confirm that the supposed organisation exists and is licensed where required, by searching the relevant registry directly rather than via any link supplied. Anyone who has already entered passwords, recovery phrases, or payment details here should change affected credentials immediately and notify their bank or provider. The address should be reported to the hosting platform's abuse desk and to a national phishing-reporting service. Evidence:

• Homepage: the page offers no verifiable operator information, so every check must start outside the site.
• Credential surface: concealed password fields were observed on the domain, so previously submitted credentials should be treated as exposed.
• Reputation listings: multiple security engines flag the domain, so a report to the platform's abuse desk is likely to be actionable.

Summary Verdict

The available evidence supports a clearly adverse trust posture. Independent security sources, the domain's prior phishing association, and its observed behaviour converge on a high-risk assessment, and nothing found offsets them. The operator's identity is unverified, and the site cannot be treated as a legitimate or trustworthy destination on the present evidence.

Infrastructure Integrity

The site sits on Amazon-operated cloud infrastructure behind the hosting platform's content-delivery layer. All observed addresses are edge nodes, and the origin server is not visible. This is mainstream, well-run infrastructure and a minor mitigating factor. It cannot offset the reputation and behavioural findings, because the same shared platform hosts legitimate and abusive sites alike. Edge-only visibility also means content can be swapped quickly without any trace at the network level.

Closing Assessment

The site should not be used for sign-in, credential entry, or any payment or financial activity. Any visit should be limited to passive viewing from an isolated environment, and no files should be downloaded from it. Users who reached it through an unsolicited message should treat that message as hostile and not act on it.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.