Is portal-moonshot-man.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a subdomain on the Netlify hosting platform. It currently serves only the platform's generic "Site not found" 404 page, which says the requested site or path does not exist and invites visitors to build their own site for free. No products, services, pricing, login or commercial content are presented, so the domain has no visible business model. The name suggests a "portal" style login destination, which does not match the empty page it serves.

Scam/Impersonation Risk

Contradictory signals are present, and they are the decisive factor in this assessment. Several independent security engines, including a major tier-one security vendor, currently flag the domain as malicious, which amounts to a confirmed blacklist hit. No confirmed phishing page, conflicting legal identities or verified brand impersonation were observed. The page analysis does flag a suspected lookalike of the hosting platform's own name, and that is a suspicion rather than a confirmed impersonation. The behavioural findings make the position worse. In every sandbox run, the near-empty error page contained concealed forms, including password-type fields, and it produced an unusually large burst of page-structure changes after interaction. A static 404 page has no legitimate reason to carry that much hidden interactive machinery. The pattern is consistent with a placeholder that can be swapped for credential-harvesting content, although no cloaking was detected and no wallet-drainer or clipboard-hijack behaviour was seen. Two abuse reports exist against an address in the hosting provider's shared network. They are attributed to shared infrastructure and discounted, so they carry no weight against this site. Evidence:

• Homepage: six security engines classify the domain as malicious, including a tier-one vendor, and the domain is also on an external blacklist.
• Homepage sandbox, three of three runs: hidden forms were detected, and password-type fields were present on a page that shows only a 404 message.
• Homepage sandbox: about 4,130 DOM mutations after interaction, against a visible page of roughly 368 characters of text.
• Hosting-network reputation: two abuse reports apply to a shared provider address and are discounted as shared-infrastructure noise.

Regulatory Verification Notes

The site gives no legal, ownership, licensing or registration information. Its only content is the platform's own error notice, so there is no operator identity to assess. No licence is claimed, and none is verified. The absence of disclosure is a verification gap and not evidence of wrongdoing on its own. Ownership opacity is an administrative limitation and not an identity contradiction. Real-world identity remains unverified, and nothing on the site connects it to a legitimate brand or person. The valid transport-encryption certificate is issued to the hosting platform, not to whoever controls this subdomain, so it shows that the connection is encrypted and says nothing about the operator. No third-party broker or regulator listing exists for the site. Evidence:

• Homepage: the page reads "Site not found" and shows no company name, address, terms, privacy policy or contact details.
• TLS certificate: issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, OV validation, subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

The domain should be treated as an unconfirmed destination until its origin is established independently. Anyone who received the link in an email, message or advertisement should contact the sender through a separate, known channel and ask whether it is genuine. Any organisation claiming to operate a "portal" at this address should be asked to confirm the exact official domain. Where the domain appears in a security or fraud context, the hosting provider's abuse channel can report it and ask whether the site is still active. The domain should be re-checked later, because a placeholder page can be replaced with different content without notice. Evidence:

• Homepage: the page carries no operator information, so no on-site claim can be checked.
• Homepage sandbox: the page's hidden-form behaviour means any later content change could introduce a credential prompt.
• Reputation checks: the current malicious classifications should be re-checked after any clean-up or ownership change.

Summary Verdict

The assessment is critical and cautionary. Active third-party malicious classifications, together with concealed credential-capable form structures on an otherwise empty page, outweigh every mitigating signal. The operator's identity is unverified, and the evidence does not support treating this destination as a legitimate service.

Infrastructure Integrity

The site sits behind AWS-fronted edge infrastructure, and all four observed addresses are edge servers in the same Amazon network. The origin server was not observable, so independent verification of the real host is limited. Edge-only visibility can also conceal rapid content swaps. The protective infrastructure and the valid certificate are mitigating factors only. They do not offset the external threat detections.

Closing Assessment

No credentials, payment details or personal data should be entered on this domain, and nothing should be downloaded from it. Any message or advertisement that directs users here should be treated as suspect and reported. At most, the page can be viewed in a read-only, isolated manner.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.