Is portal-moonshot-qlv.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a free-tier subdomain on the Netlify hosting platform. At the time of analysis it serves only the platform's default "Site not found" error page. The page says the requested address does not exist on Netlify, shows an internal reference ID, and invites the visitor to "Build and deploy your own site." It offers no product, service, business description, contact details, or policies, so no business model can be identified. It is a placeholder or an abandoned deployment, not an operating business.

Scam/Impersonation Risk

Contradictory signals are present, and the assessment is cautionary. Several independent threat-intelligence engines classify this address as malicious, including at least one top-tier security vendor, and an external blacklist listing is confirmed. This is the decisive factor, and the platform's protective infrastructure cannot offset it. The visible page is the host's genuine default error page, and content analysis found no phishing form, no login prompt, and no impersonation copy. The browser sandbox nonetheless observed hidden forms, including password-type fields, in every one of its repeated runs, even though the rendered page shows none. It also recorded a very large volume of DOM mutations after interaction and an almost entirely external request profile. A visible 404 shell that conceals form elements and reacts heavily to interaction is consistent with a page being staged or swapped, and it contradicts the benign appearance. The hostname is a near-lookalike of the hosting platform's own domain. This follows from how platform subdomains are built and was flagged as a brand-resemblance concern, not a confirmed impersonation. Abuse reports on file relate to a shared cloud-provider address and apply to infrastructure used by many tenants, so they carry little weight against this site specifically. No identity contradiction (conflicting legal entities) was observed, because the site names no entity at all. Evidence:

• Homepage: shows only the default 404 text and a "Start building" prompt, with no products, forms, or sales content.
• Browser sandbox, homepage: hidden forms detected in all 3 runs, with 3 password forms and roughly 4,130 DOM mutations after interaction.
• External reputation: 7 engines return a malicious verdict, one of them a tier-1 vendor, and an external blacklist hit is confirmed.
• Shared-infrastructure abuse reports (4) apply to a cloud-provider edge address, not to a site-specific operator.

Regulatory Verification Notes

The site presents no legal, ownership, licensing, or regulatory information, because no legal pages or company disclosures exist on it. Operator identity is therefore not established. The valid transport-encryption certificate names the hosting platform as the certificate subject, not the site's operator. It confirms an encrypted connection to the platform and says nothing about who controls this subdomain. No financial service is advertised, so no license is expected, and the absence of one is not evidence of wrongdoing. The absence of any accountable party does remove the means of recourse that a legitimate counterparty would normally provide. No third-party broker or regulatory-database entry was matched for this site. Evidence:

• Homepage: no company name, address, terms, privacy policy, or registration number.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• TLS: certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organization Netlify, Inc, valid to 2027-03-19.

What to Verify Next

The primary question is whether the address is a stale placeholder or an active staging area for a different page. Anyone with a legitimate reason to engage should obtain the intended site address from the claimed counterparty through an independent, offline channel, not from this link. The party that shared the link should also be asked for a verifiable legal entity name and official contact route. Where possible, the link's origin (message, advertisement, or referral) should be reviewed and reported to the platform's abuse team if it arrived unsolicited. Registry confirmation of the claimed entity should wait until the entity is identified. Evidence:

• Homepage: contains no information that could be used to identify or contact an operator.
• Browser sandbox: hidden password-type forms indicate that the content seen today may not be what is served later.
• External reputation: current malicious classifications suggest the link should be treated as suspect until the sender is independently validated.

Summary Verdict

The overall posture is high-risk and clearly cautionary. Confirmed adverse external classifications, concealed form behaviour, and the absence of any identifiable operator outweigh the benign appearance of the visible page. Nothing on the site supports a presumption of legitimacy.

Infrastructure Integrity

The site is delivered through Amazon Web Services edge infrastructure in the United States, behind the Netlify platform's CDN. All four observed addresses are edge nodes, and no origin server could be observed, which limits independent hosting verification and can mask rapid content swaps. Protective infrastructure is a mitigating factor only. It reduces exposure to hosting-level compromise, but it does not offset the adverse threat classifications and says nothing about who controls the content.

Closing Assessment

The site should be treated as unsafe for any sensitive interaction. Login, credential entry, and financial or personal data submission should be avoided, and nothing should be downloaded from it. Any engagement should wait until a counterparty provides a separately verified, independently sourced address and identity.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.