Is portal-moonshot-oco.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a public static-hosting platform whose homepage returns the platform's generic "Site not found" 404 page. The page says the address does not exist and offers a "Start building" prompt for the hosting service. It presents no products, services, company information, contact details or monetization model. Its apparent purpose therefore cannot be determined from the visible content. The hostname, a "portal" style name with a "moonshot" label, suggests a deployment staged for a user-facing portal that is not currently resolving to published content.

Scam/Impersonation Risk

Contradictory signals are present, and they come from external reputation rather than from the page text. Several independent security engines currently flag the domain as malicious, including one tier-one vendor, and this amounts to a confirmed blacklist listing. The detections do not say whether the concern is phishing, malware or something else, so the nature of the threat is unspecified. The visible 404 page carries no fraud language and no solicitation. The browser-behavior evidence conflicts with that quiet surface. Across all three sandbox runs, the page contained concealed forms, including password-type fields, even though the visible content is only an error notice. Interaction also triggered an unusually large burst of page restructuring, which means the displayed placeholder is not the whole of what the page can render. A hidden credential-capture surface behind an innocuous error page is a recognised pattern for staged phishing infrastructure. Separately, the hostname closely resembles the hosting platform's own brand, which raised a lookalike-naming signal. No confirmed impersonation or conflicting legal identities were observed. Four abuse reports were recorded against an address in the shared hosting provider's range. These reflect shared infrastructure and cannot be attributed to this site specifically, but they were not discounted in the assessment. Evidence:

• Homepage: the captured page is a hosting-provider 404 notice with no business content, forms, links or tracking elements visible.
• Homepage behavior: concealed forms with password-type fields were detected in 3 of 3 sandbox runs, and the page showed 4,130 DOM mutations after interaction.
• External reputation: 5 engines reported the domain as malicious, and the combined detections confirm a blacklist listing.
• Shared provider address: 4 abuse reports were logged against a shared-infrastructure address (confidence score 1), not attributable to this operator specifically.

Regulatory Verification Notes

No legal, terms, privacy, about or contact pages were captured, so no licensing claim, registration number, company name or regulator reference can be assessed. Because the page is a platform placeholder, the missing disclosures say little about the intended operator's conduct. They also mean nothing on the site supports identity verification, and the real-world operator remains unverified. The ownership and governance picture is opaque, and no on-site disclosure offsets it. This is a verification gap, not evidence of wrongdoing on its own. The reputational concern rests on the external detections described above, not on this gap. No third-party broker or regulator listing matched this domain, so there is no independent regulatory context. Evidence:

• Whole site: no legal-entity name, license, registration number, terms or privacy page was captured, and the homepage reported 404 status.
• Transport encryption: the TLS certificate is organization-validated (OV), issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc., and valid to 2027-03-19. It authenticates the hosting platform and says nothing about the operator behind this subdomain.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

The first step is to establish who controls this subdomain and what it is meant to serve. The party that supplied the link, such as an email, message or advertisement, should be contacted through a separately known channel and asked to confirm that it published this address. Anyone who received a link containing this hostname should compare it against the official address of the organization it claims to represent, obtained independently. The official support or contact channels should be confirmed directly. If the link purports to lead to an account or payment portal, access should be via the organization's known primary domain only. Any organization that appears to be impersonated should be notified so it can request takedown through the hosting platform's abuse process. Evidence:

• Homepage: the page offers no operator, brand or contact information to check, so confirmation must come from outside the site.
• Hostname: the site is a subdomain of a public hosting service, so control over the address can change without the platform's reputation changing.
• Sandbox behavior: the concealed credential-type fields make it unsafe to test the site by submitting any information.

Summary Verdict

The assessment is a clearly elevated-risk posture. Confirmed external threat detections combine with concealed credential-type form behavior beneath a blank placeholder page. No identity evidence offsets these, because none is verifiable. The result is a critical trust rating that the site's technical hygiene cannot lift.

Infrastructure Integrity

The site is served from addresses in Amazon's network (AS16509) behind the hosting platform's cloud edge, and all four observed addresses are edge nodes. The origin server was not observable. The certificate is valid and issued by a mainstream authority. This is a mitigating factor only. It shows that the platform's infrastructure is sound and does not show that the content or operator is trustworthy. Edge-only visibility also means the content behind the hostname can change quickly without any change in the infrastructure.

Closing Assessment

The site should not be used for sign-in, credential entry or any financial or personal-data interaction. Links to it should be treated as untrusted until the legitimate operator is independently confirmed. Any credentials already entered should be changed on the genuine service.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.