Is portal-moonshot-rp2.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a shared hosting platform whose only visible content is the platform's generic "Site not found" error page. The page reports a broken link or a non-existent path. It shows no products, pricing, forms, links, contact details or commercial claims, so it has no discernible business model or purpose beyond an unclaimed or non-functional deployment. The hostname styles itself as a "portal", but nothing on the page supports that name.

Scam/Impersonation Risk

Contradictory signals are present, and they outweigh the harmless appearance of the page. The site is blacklisted: multiple independent security engines classify it as malicious, and a top-tier security vendor is among them. The hostname's wording also closely resembles the hosting platform's own brand. The page analysis therefore flags possible brand lookalike behaviour, which is a notable feature of a name that is meant to look like a legitimate portal. The most important mismatch is between what is shown and what was observed running. The visible page is a bare error screen with no forms. Yet the behavioural sandbox detected concealed forms, including password-type fields, in every run. It also detected a very large volume of page changes after interaction, far beyond what a static error page would produce. A credential-capture mechanism that is dormant or staged behind a placeholder is consistent with this pattern. These behaviours are not proof of phishing, but they are a serious reason for caution. No conflicting legal identities were found. The site publishes no legal or identity pages that could conflict. The site's age also gives no reassurance, because it was created only very recently. Evidence:

• Homepage: renders only the hosting platform's 404 notice, with no visible forms, links or services, yet concealed password-bearing forms were detected in all three sandbox runs.
• Homepage behaviour: roughly four thousand page mutations after interaction, which is anomalous for a static error screen.
• External reputation: five malicious verdicts from independent security engines, including a tier-one vendor, alongside no clean-reputation offset.
• Domain provenance: registered in 2026 (~14 days old), with a single web-archive snapshot dated 2026-10-05 and no earlier history.

Regulatory Verification Notes

The site provides no legal or identity pages, no named operating entity, no jurisdiction, no terms or privacy policy and no contact channel. It claims no licence or registration number. Because there is no content to assess, the real-world operator cannot be independently tied to any person or business. Ownership and governance are opaque as a result, and that opacity is administrative rather than a contradiction in itself. No third-party broker or regulator record was matched, so there is no reputational context beyond the security-engine detections described above. The transport layer is technically sound but says nothing about who operates the site. Evidence:

• Homepage: no company name, address, licence, policy or contact information is published.
• Transport encryption: an organisation-validated TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, naming Netlify, Inc as subject and valid to 2027-03-19, which reflects the hosting platform and not the site's operator.
• Hosting: served from AS16509 (AMAZON-02 – Amazon.com, Inc., US).

What to Verify Next

Anyone who received this address should confirm through an independent, offline route, such as a known phone number or an in-person contact, who sent it and what service it was meant to reach. It should be established whether the intended destination is a different, officially published address, since this deployment currently serves nothing. Any institution, brand or service that the "moonshot portal" name is meant to evoke should be asked directly whether it operates this address, using its official published contact channels. The reputation status should be re-checked later to see whether the detections persist or the hosting platform removes the deployment. Evidence:

• Homepage: no stated owner or destination, so provenance depends entirely on the sender of the link.
• Hostname: the portal-style name offers no verifiable link to any identifiable organisation.
• Reputation checks: current detections remain active and should be re-queried after any change to the deployment.

Summary Verdict

The site presents an elevated-risk posture. Active security-vendor detections and concealed credential-type form behaviour outweigh the benign appearance of its placeholder page. The evidence shows a very young, unidentified deployment with no verifiable operator and unresolved reputational and behavioural contradictions.

Infrastructure Integrity

The site is served through the hosting platform's cloud and CDN layer on Amazon infrastructure. All observed addresses are edge servers, and the origin server was not observable. This is a mitigating factor only and does not offset the detections above. Four abuse reports were recorded against one of the edge addresses. They apply to shared provider infrastructure used by many tenants, so they are not attributed to this site specifically.

Closing Assessment

Entering credentials, signing in, making payments or sharing personal information should be avoided at this address. The page may be opened for read-only inspection only from an isolated environment. Any message or advertisement directing users here should be treated with suspicion until its sender is independently confirmed.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.