Is portal-moonshot-r84.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is an unconfigured Netlify-hosted subdomain with a "portal" and "moonshot" style name. When loaded, it shows only the platform's generic "Site not found" 404 page. The page names no operator, describes no service, and shows no pricing, offers or contact details, so the site's purpose and business model can't be determined from what it displays. The page's own text says the site or path is not deployed.

Scam/Impersonation Risk

Contradictory signals are present, and they carry the risk assessment for this site. The domain is blacklisted: several leading security engines independently classify it as malicious, and a further engine marks it suspicious. That level of agreement is decisive. A separate abuse-report history exists for one of the addresses serving the site. Those reports sit on shared cloud infrastructure, so they say less about the operator than the engine detections do. The visible page is benign-looking and carries no deceptive copy, so the danger lies in what the page does rather than what it says. Across all three sandbox runs, the page contained hidden forms, including password-type fields, even though it displays no form to a visitor. It also showed very heavy DOM change after interaction. A hosting error screen should not do either. This pattern fits a placeholder that can be switched quickly into a credential-capture page, or a page whose behaviour differs from its visible content. No conflicting legal identities and no confirmed brand impersonation were observed. The domain name does closely resemble the hosting platform's own, which is expected for a subdomain on that platform and is not by itself evidence of impersonation. The assessment therefore rests on the threat detections and the hidden-form behaviour. Evidence:

• Homepage: it shows only a hosting-platform 404 "Site not found" screen with a platform-generated internal ID, and no operator, product or contact content.
• Reputation checks: ten security engines flagged the domain as malicious and one as suspicious, including three major endpoint-security vendors. The detections triggered the external-blacklist rule and capped the assessment at its lowest band.
• Behavioural sandbox: three of three runs detected hidden forms with password fields, and about 4,130 DOM mutations followed interaction on a page with no visible forms.
• Abuse reporting: four reports were recorded against one edge address, attributed to shared provider infrastructure and not discounted.

Regulatory Verification Notes

The only page available is a platform error screen, so there are no legal, terms, privacy, about or contact pages to assess. No licence, registration number, company name or regulator is stated anywhere on the site, and no operator can be tied to this domain. The absence of any disclosure is a content gap, not a finding on its own, but here it sits alongside confirmed threat detections. No third-party broker or regulatory record matched this domain, which adds no reputational context either way. The valid, organisation-validated TLS certificate is issued to the hosting platform, not to whoever controls this subdomain. It confirms encrypted transport and nothing about the operator's legitimacy. Evidence:

• Homepage: the page contains no legal entity, licence claim, jurisdiction or policy text. Its only call to action is the platform's own "Start building" prompt.
• Transport encryption: the TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 at OV level to the subject organisation "Netlify, Inc", valid to 2027-03-19.
• Hosting: the site is served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).

What to Verify Next

Any claim that this address is an official portal for a business should be checked independently before anything else. Confirm the correct address through the organisation's own known website, a printed document or a phone number obtained independently, and not through a link or message that pointed to this domain. If the page was reached through an email, message or advertisement, treat that source as suspect and report it. Site owners and platform administrators should check whether the deployment was removed or hijacked, and should audit any forms or scripts attached to the site. The site should be re-assessed only once it serves real content with a named operator and the threat detections have cleared. Evidence:

• Homepage: the platform message says the path is not deployed, so no live service currently exists to verify against.
• Behavioural sandbox: the hidden password-type forms are the specific artefact to inspect during any owner-side audit.
• Reputation checks: the active malicious detections must be cleared and re-tested before any change in posture.

Summary Verdict

This domain should be treated as a high-risk asset. Confirmed blacklisting and behaviour inconsistent with its visible content outweigh the benign appearance of the error page and the platform-level technical hygiene. The operator's real-world identity is unverified, and the evidence supports an elevated-risk, cautionary posture and not a neutral one.

Infrastructure Integrity

The site is served through Amazon Web Services edge infrastructure. Four edge addresses were observed, all within the same Amazon network, and the origin server was not observable in this analysis. This is established, mainstream infrastructure and shares the platform's valid certificate chain, which is a mitigating factor only. Shared edge hosting makes independent hosting verification difficult and allows content to be swapped quickly. These protections cannot offset the confirmed threat detections.

Closing Assessment

Do not enter credentials, passwords or payment details on this domain, and do not follow links or open downloads that originate from it. If a message or advertisement directed a user here, they should stop interacting with it and report it to the organisation it claims to represent.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.