Is portal-moonshot-uhv.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a subdomain on a shared website-hosting platform. When visited, it shows only the platform's default "Site not found" error page, with no branding, products, forms, contact details or commercial offer. Its apparent purpose cannot be established from the visible content. The hostname, which reads like a login-style "portal" name, together with the external threat detections, suggests it may be a staging or lure address that was used and then withdrawn.

Scam/Impersonation Risk

The site carries clear contradictory signals, and the assessment is cautionary. Several independent external security sources have blacklisted the address as malicious, and two major security vendors are among the detections. This is a confirmed reputational contradiction. The page content is not reassuring either. The page analysis flagged a suspected resemblance to the hosting platform's own brand, which is consistent with a lookalike hostname. Automated browsing sessions also observed hidden form elements and password-form markers in every run, and very large DOM changes after interaction. A static error page that shows no visible forms should not behave this way. This suggests content that is not shown to a casual visitor or that changes after load. No conflicting legal identities were found, but there is also no identity content to compare. Two abuse reports exist against a shared cloud address, but they are attributed to shared provider infrastructure and are discounted. They are not counted against this site. Evidence:

• Homepage: shows only a generic "Site not found" notice, with no products, branding, contact details or legal text.
• External reputation: 8 malicious and 1 suspicious detections, including two tier-one security vendors.
• Behavioural sessions: hidden forms were detected in 3 of 3 runs, along with password-form markers. The maximum DOM change after interaction was 4,130 mutations on a page whose visible text is only 368 characters.
• Hostname: the name closely resembles the hosting platform's brand and was flagged as a suspected lookalike.

Regulatory Verification Notes

The site contains no legal, identity or licensing content. It names no company, registration number, regulator or licence, and offers no terms, privacy or contact pages. Operator identity therefore cannot be tied to any real-world person or organisation, and it remains unverified. This is a verification gap, and it is not an accusation by itself. It matters here because it adds to the confirmed external contradictions instead of offsetting them. No third-party broker or regulatory record was matched. The valid certificate and mainstream cloud hosting are technical hygiene. They do not show the operator's legitimacy or intent. Evidence:

• Homepage and all captured content: no company name, licence, address or legal pages.
• Transport encryption: the TLS certificate is organisation-validated (OV), issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19. It belongs to the hosting platform, not to an independently identified site operator.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

What to Verify Next

Anyone who received this address should confirm independently who sent it and why. Use an offline or previously known channel for this, not any contact route found through the address itself. The expected organisation's official domain should be obtained from a trusted source, such as a prior statement, a regulator register or a known app, and compared character by character. Any request to log in, enter credentials or move funds that points to this hostname should be treated as unsolicited until it is confirmed through that independent route. A later re-scan is worthwhile if the site begins serving real content, because the hidden-form behaviour could become visible then. Evidence:

• Homepage: no visible content exists to check against any claimed organisation.
• Behavioural sessions: password-form markers and hidden forms were observed repeatedly, so any content that later appears should be treated as untrusted until reviewed.
• Hostname: the portal-style subdomain name is the only identifying artifact available for comparison with an official address.

Summary Verdict

The available evidence supports an elevated-risk, clearly cautionary classification. Multiple external security sources have flagged the address as malicious, and its observed behaviour does not match its blank appearance. The operator's real-world identity is unverified and the content provides no basis for legitimacy. The technical hygiene is not enough to offset the confirmed reputational contradictions. Use is limited to passive, read-only viewing.

Infrastructure Integrity

The site runs on a shared hosting platform on Amazon's cloud, behind that platform's CDN and WAF. All four observed IP addresses are edge nodes, and the origin server could not be seen. This mitigates direct exposure of the host. It also limits independent hosting verification, and content can be swapped quickly behind the edge. The protection is a mitigating factor only. It does not outweigh the external threat detections.

Closing Assessment

Do not enter credentials, personal data or payment details on this address, and do not follow any login or transaction request that leads to it. Passive viewing carries lower exposure. Any message that directed a recipient here should be reported to the claimed sender's official security channel and to the recipient's own security team.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.