Is portal-moonshot-slb.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website is a subdomain on a shared application-hosting platform, with a name styled as a "portal" (moonshot-slb). A visitor sees only the platform's generic "Site not found" 404 error screen. There is no product, service, sign-in, pricing, contact or legal content, so no business model is visible. The name reads like a login or customer-portal address, but the page presents no actual purpose.

Scam/Impersonation Risk

The evidence converges on an elevated, security-forward risk posture. The domain is blacklisted by multiple external threat-intelligence sources. Several independent detection engines flag it as malicious, including one top-tier security vendor, and a further engine rates it suspicious. The hosting platform's own name is suspected of being imitated in the subdomain, and the page copy reinforces that resemblance. The visible 404 page does not match the behavior observed in the sandbox. Across all three automated runs, the homepage contained hidden forms, including password-type fields, even though no form is visible. Interaction also triggered a very large burst of DOM changes, which suggests content is assembled or swapped after load. A hidden credential form behind an error screen fits a staged or dormant credential-collection page better than an abandoned deployment. This is a pattern consistent with phishing staging, not proof of an attack. The abuse reports recorded against one of the serving addresses belong to a shared platform address used by many tenants, so they are weak evidence about this site. They are not what drives the assessment. No conflicting legal identities were found, because no identity content is published at all. Evidence:

• Homepage: a platform 404 "Site not found" screen with no visible forms, yet hidden forms with password fields were detected in every sandbox run.
• Homepage: post-interaction DOM mutations numbered over 4,000, and the subdomain closely resembles the hosting platform's own name.
• Domain provenance: the subdomain is about 13 days old (~0.04 years), with 1 archive snapshot spanning a single year (2026).
• Reputation: 5 engines flag the site as malicious and 1 as suspicious, with one top-tier vendor among the detections. Four abuse reports exist against a shared platform address.

Regulatory Verification Notes

The site publishes no legal, licensing, ownership or policy content. No company name, registration number, regulator or terms page exists, and the page was classified as an error screen, so no business activity is claimed. Operator identity cannot be tied to any real-world person or organization, and governance and ownership opacity are present. Because the site makes no regulated-activity claim, this is a disclosure gap and not a licensing violation. It matters here only because it removes any mitigating accountability from the threat detections. No third-party broker or regulatory-database entry was matched for this site, so there is no reputational context from that source either. Evidence:

• Homepage: the only content is a platform error notice, with no legal entity, license or policy text.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: the TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19. It identifies the hosting platform, not the site's operator.

What to Verify Next

Credentials, payment data or personal information should not be submitted on this address. If a message, advertisement or message thread directed someone here, its sender should be checked independently of that message. The genuine portal address should be obtained directly from the organization the "moonshot-slb" name appears to reference, through an offline or previously known channel. The destination can also be reported to the hosting platform's abuse team and to the organization it appears to imitate. If an account was already accessed from this address, its password should be changed and multi-factor authentication enabled. Evidence:

• Homepage: no visible sign-in or contact path exists, so any request to log in here did not come from a legitimate page on this site.
• Sandbox: password-type fields are present but hidden, which means a credential request could appear without notice.
• Provenance: the very recent creation of the subdomain, with no archive history, offers no prior legitimate use to check against.

Summary Verdict

The available evidence supports a clearly cautionary, high-risk posture. Confirmed external threat detections, concealed credential-capture behavior and a very recent, unverifiable origin outweigh the technically valid encryption. The site is best treated as a suspected staging or phishing asset until proven otherwise, and its operator remains unidentified.

Infrastructure Integrity

The site is delivered through Amazon's cloud edge network, so all four observed addresses are edge addresses and the origin server could not be seen. Together with a valid certificate, this shows only that a mainstream platform hosts the site. It is a mitigating factor, not proof of legitimacy, and it cannot offset the reputation risk. The same edge-only visibility means the underlying content can be changed quickly without any change in the surface-level infrastructure.

Closing Assessment

Interaction beyond passive viewing is not appropriate: no logins, no credential entry and no financial or personal-data submission. Anyone who has already entered information here should change the affected passwords promptly and monitor the related accounts.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.