Is portal-moonshot-mzv.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared hosting platform that currently serves only the platform's generic "Site not found" error page. The page says the visited address does not exist and invites visitors to build their own site, and it shows no products, services, pricing, forms, branding or links. The subdomain name suggests a "portal" for a project called "moonshot", but no business model or operator is observable. Its apparent purpose is unclear: it may be a deployment that was removed or never published, or a placeholder address.

Scam/Impersonation Risk

Contradictory signals are present. Several independent security vendors, including two tier-one vendors, currently flag the domain as malicious, and this amounts to a confirmed blacklist hit. The domain has also been associated with known phishing activity. No conflicting legal identities and no confirmed brand impersonation were observed. The name's resemblance to the hosting platform's own domain is a lookalike similarity, not proven impersonation. The visible page contains no login form or fraud indicators. Behavioral testing found otherwise: in every one of three sandbox runs, hidden form elements, including password-type fields, were detected beneath the error page. The document also underwent very large structural changes after interaction. A static 404 does not normally behave this way, so the visible content may not represent what is delivered in other conditions. All observed outbound requests went to allow-listed destinations, and no cloaking, wallet-drainer or clipboard-hijack behavior was found. The combination of external threat detections and concealed credential-capable elements is the decisive risk driver. Evidence:

• Homepage: displays only a hosting-platform "Site not found" message with no business content, forms or links.
• Behavioral sandbox: hidden forms were detected in all three runs, with password-type fields and several thousand DOM mutations after interaction, while the rendered page showed no forms.
• Reputation: eight malicious detections from external security vendors, including two tier-one vendors, and a prior phishing association.
• Outbound traffic: no requests to non-allow-listed destinations and no cloaking observed.

Regulatory Verification Notes

The site presents no legal, terms, privacy, about or contact pages, so there is no company name, licence, registration number or jurisdiction to assess. The real-world operator has not been independently connected to any brand or person, and no on-site claim can be taken as proof of identity. A valid organization-validated TLS certificate is present, but it is issued to the hosting platform rather than to any site operator. It confirms transport encryption and says nothing about the legitimacy of whoever controls this subdomain. No regulatory standing can be attributed to this site. Evidence:

• Served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organization Netlify, Inc, valid to 2027-03-19.
• Homepage: no legal-entity name, licence statement or policy pages.

What to Verify Next

Anyone who received this address through an email, message, advertisement or QR code should establish who sent it and why. The sender and the claimed organization should be contacted through an independently sourced channel, such as a phone number or website known from prior dealings, to confirm that this portal is real. The claimed organization's official domain should be located from an independent source and compared with this address. If the address was meant to be a login or onboarding portal, the organization should be asked to confirm the official portal address and whether this one was ever issued. Any requests made through this address should be treated as unconfirmed until that confirmation is received. Evidence:

• Homepage: no identifying content links the address to any named organization.
• Domain name: a "portal"-style label on a shared platform subdomain, which any account holder can register freely.

Summary Verdict

The overall posture is high-risk. External threat intelligence and concealed credential-capable behavior outweigh the benign appearance of the visible page, and the site's identity cannot be established. The valid encryption certificate and the platform's reputation do not offset those signals.

Infrastructure Integrity

The site sits on a major cloud and edge platform. All four observed addresses are edge nodes of that provider, and no origin server was observable. This protective infrastructure is a mitigating factor only. It cannot offset the threat detections, and edge-only visibility also makes it harder to verify what sits behind the address or to detect rapid content changes. A handful of abuse reports exist for one of the edge addresses. They apply to shared provider infrastructure used by many tenants, so they carry little weight against this specific site.

Closing Assessment

This address should be treated as unsafe for any login, credential entry or financial interaction. If it was received unsolicited, it should not be opened, and any message that supplied it should be reported. Interaction should be limited to passive viewing until a trusted party independently confirms the address.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.