Is portal-moonshot-nea.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page deployment on a free application-hosting platform, and the page it serves is the platform's default "Site not found" error. The page shows no products, offers, forms, pricing or business claims. Its apparent purpose cannot be determined from the content. The address is a portal-style subdomain that reads like a project or staging placeholder rather than an operating business.

Scam/Impersonation Risk

Contradictory signals are present, and they carry the weight of this assessment. Several security engines currently flag the address as malicious or suspicious, including at least one top-tier vendor, and the site is on a confirmed blacklist. That is a hard reputational contradiction that the harmless-looking error page does not offset. The sandbox also recorded concealed form elements in every run, including password-type fields, even though nothing visible is presented to a visitor. The page's structure also changed heavily after interaction. A page that is empty on the surface but loads concealed credential-capable forms and shifts its content is consistent with a staged or cloaked phishing kit. It also fits a deployment that was parked and later swapped for other content. The name also closely resembles the hosting platform's own brand, which raised a lookalike flag. This is a soft indicator and not a confirmed impersonation. No conflicting legal identities were found, because the site names no entity at all. Four abuse reports are attached to a shared network address used by the hosting platform. They apply to shared infrastructure and are not attributed to this site, so they add no independent weight against it. Overall, the evidence supports a clearly cautionary stance. The blacklist and the concealed credential-capable forms are what drive it. Evidence:

• Homepage: only the platform's default 404 message is shown, with no business content, yet three of three sandbox runs detected concealed forms, including password fields.
• Homepage behaviour: about 4,130 DOM mutations after interaction, which is far beyond what a static error page would produce.
• Reputation: 4 malicious and 1 suspicious detections across the security engines consulted, including one top-tier vendor, plus a confirmed blacklist listing.
• Domain provenance: the address was first observed on 2026-10-07 with a single archive snapshot (about 13 days of tracked history, registered 2026).

Regulatory Verification Notes

The site has no legal, terms, privacy, about or contact pages, and no licence or registration claim. Only the hosting platform's placeholder is visible, so there is no regulatory standing to assess. The operator is unidentified, and ownership and governance are opaque. This is a transparency gap and does not by itself indicate fraud. No third-party broker or regulator record matches this address, so no external reputational context applies. The valid, organisation-validated certificate is issued to the hosting platform, not to any operator of this site. It shows that the transport layer is sound and does not link the site to a real-world business. Evidence:

• Entire site: no named company, licence, registration number or policy pages are published.
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Broker and regulator lookup: no match found for this address.

What to Verify Next

The site should not be treated as an operating business until its operator is independently identified. The first step is to ask whoever supplied the link for the organisation's official, separately sourced website address. Any claimed company should then be checked against the relevant corporate and financial-services registers. Official support channels should be confirmed through an independent, offline route. If the link arrived by message or email, the sender should be asked to confirm it through another channel. Security teams should re-test the address later to see whether the content changes from the current placeholder. Evidence:

• Homepage: no entity name or contact route is published to verify against.
• Reputation records: the current blacklist and malicious detections should be rechecked after any content change.
• Provenance: a very recent first appearance with a single archive capture gives no track record to rely on.

Summary Verdict

The site carries an elevated risk posture. Its content is an empty placeholder, but confirmed blacklisting, multiple malicious detections and concealed credential-capable forms outweigh the technically sound encryption. Its operator is unidentified. The available evidence does not support treating the site as trustworthy.

Infrastructure Integrity

The site is served from Amazon's network behind a content-delivery and web-protection layer, and all four observed addresses are edge servers. The real origin server could not be observed. The platform's protection and a well-formed certificate are mitigating factors only. They do not offset the reputation risk, and edge-only visibility prevents independent hosting verification and can mask rapid content swaps. The hosting is an established, mainstream platform and the infrastructure is stable, but a reputable host says nothing about the legitimacy of whoever deploys on it. Evidence:

• Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), registered with ARIN.
• Edge exposure: four edge IPs observed, no origin candidates, and a low DNS time-to-live consistent with rapid rotation.

Closing Assessment

Interaction should be limited to passive viewing in an isolated environment. The site should not be used for logging in, entering credentials or making payments. Nothing should be downloaded from it, and it should be treated as unsafe for any sensitive action until its operator is independently identified and the current security listings are cleared.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.