Is portal-moonshot-phx.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a bare hosting-platform error page, not a functioning website. The address is a tenant subdomain on Netlify's shared hosting service, and it shows only the platform's default "Site not found" 404 message with a "Build and deploy your own site for free" prompt. The page has no products, services, forms, claims, contact details or monetization, so its business purpose cannot be determined from what it presents to a visitor.

Scam/Impersonation Risk

The evidence converges on a materially elevated risk despite the empty page. A tier-one security vendor and several other reputation engines classify the address as malicious, and an external listing is active, so the address is blacklisted on third-party reputation sources. The only abuse reports found attach to a shared edge address belonging to the hosting provider, not to this tenant. They carry no weight on their own and are discounted, so the blacklisting rests on the malicious classifications. The address itself is a generic tenant name on the shared platform. Automated lookalike checks flagged similarity to the platform's own domain, but no impersonation of a specific brand was confirmed and no conflicting legal identities exist. The sandbox runs behaved differently from what the placeholder suggests. Hidden forms appeared in every run, password-type fields were detected, and the page structure mutated heavily after interaction. Final-destination behavior was also marked suspicious. A 404 page that nonetheless carries concealed input forms and large post-load changes is consistent with content being swapped in or staged, and the benign placeholder cannot be assumed to be what a visitor would later receive. External-request volume was heavy, but none of it went to non-whitelisted destinations, and no wallet, clipboard or fingerprinting activity was seen. Evidence:

• Homepage: renders only the default hosting-platform 404 message, with no business content, no visible forms and no contact artifacts.
• Sandbox behavior: hidden forms were detected in all three runs, with password-type fields present and about 4,130 DOM mutations after interaction.
• External reputation: multiple malicious classifications, including one from a tier-one vendor, and an active external blacklist listing.
• Abuse reports: low-confidence reports tied to a shared hosting-provider edge IP, discounted as shared infrastructure.

Regulatory Verification Notes

The page contains no legal entity name, terms, privacy policy, licensing statement or registration number, because it is a platform placeholder with no operator disclosures. The operator therefore cannot be independently connected to any real-world business or person, and the site claims no regulated status. No third-party broker or regulatory-database record matched this address, which means there is no reputational context from that source either way. Transport security is present and well-formed, but a valid certificate on a shared hosting platform reflects the platform's provisioning and says nothing about the tenant's legitimacy or intent. Evidence:

• Homepage: no company name, licence, registration number or operator contact is disclosed.
• Transport encryption: OV-level TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to the subject Netlify, Inc, valid to 2027-03-19. The certificate belongs to the hosting platform, not an independent operator.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

Any party being asked to interact with this address should first establish who controls it and why it is being offered. The sender should identify the real organization behind it through an independent channel such as a known official website, a published phone number or an established business relationship, and not through anything in the link or message that supplied it. If a specific service is promised, the legitimate operator should be asked to confirm the exact official address in writing. The official support or contact channels should also be confirmed through an offline route. Because the content can change after capture, the address should be re-examined only in an isolated environment, and security teams should consider reporting it to the hosting platform's abuse process. Evidence:

• Homepage: shows no operator, product or service that could be matched to a known organization.
• Sandbox behavior: concealed forms and post-interaction DOM changes mean the final content is not stable between a first look and later use.
• External reputation: the active malicious classifications are the reason independent confirmation is needed before engagement.

Summary Verdict

The address warrants a clearly cautionary, high-risk posture. Confirmed adverse reputation from several security sources, combined with concealed input behavior that contradicts the innocuous placeholder, outweighs the neutral appearance of the page and any technical hygiene. The operator's real-world identity remains unestablished, and nothing in the evidence supports treating the address as legitimate.

Infrastructure Integrity

The address resolves to Amazon-hosted cloud infrastructure behind the Netlify platform's content-delivery layer, and all observed addresses are shared edge nodes, with no origin server visible. Established, trusted infrastructure and a valid certificate are mitigating factors only. They cannot offset the reputation findings, and because only the edge is observable, the underlying hosting cannot be independently checked and content could be swapped without a visible infrastructure change.

Closing Assessment

Account logins, credential entry, payments and any financial interaction through this address should be avoided. Any contact with it should be limited to isolated, non-sensitive inspection by security personnel, and nothing should be downloaded or submitted until the operator is independently identified and the adverse detections are cleared.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.