Is portal-moonshot-wi6.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a subdomain on a shared website-hosting platform that, when captured, served only the platform's generic "Site not found" error page. The page says the requested address does not exist and offers a link to the platform's support guide and a "Start building" prompt. It shows no products, services, commercial offer or business model, so any real purpose behind the address is not visible. The address reads like a portal or login-style label ("portal-moonshot"), which fits a staging or credential-collection page better than a published brand.

Scam/Impersonation Risk

This assessment is cautionary. Contradictory signals are present, and they come from outside the page rather than from its visible content. Multiple independent security engines currently flag the address as malicious or suspicious, including a major tier-one security vendor. That constitutes a confirmed blacklist-level detection. No conflicting legal identities were found, because the captured page names no entity at all. Browser-sandbox runs add a behavioural concern the static page does not show. Across all three runs, hidden forms were detected and password-entry fields were present, even though the visible 404 content contains no form or login element. The page also changed heavily after interaction, which suggests content is injected or swapped after load. The address itself closely resembles the hosting platform's own domain name, which is consistent with a lookalike or portal-style lure, although no brand impersonation was confirmed in the visible content. Two abuse reports exist against one of the shared edge addresses. They apply to the provider's shared infrastructure rather than to this site specifically, so they carry little weight here. The weight of the assessment rests on the engine detections and the hidden credential-capable forms behind an innocuous error page. Evidence:

• Homepage capture: a generic "Site not found" error page with no commercial, financial or data-collection content visible.
• Reputation checks: 3 engines rated the address malicious and 1 suspicious, with a tier-one vendor among the detections.
• Behavioural sandbox: hidden forms and password fields were observed in 3 of 3 runs, with about 4,130 DOM mutations after interaction.
• Address structure: a subdomain whose name closely resembles the hosting platform's own domain.

Regulatory Verification Notes

The captured page carries no legal, identity, licensing or registration content. It is a platform error page, so there is nothing to assess for corporate disclosure, terms or privacy documentation. No licence or regulatory claim is made, and none could be matched to a regulator. Ownership and governance of the address are opaque, meaning no operator can be linked to it. This is an administrative limitation and not an identity contradiction. No third-party broker-reputation match exists for the address, so there is no broker warning to weigh. The technical layer is clean but does not establish who operates the subdomain. The certificate is a valid organisation-validated one issued to the hosting platform itself, not to whoever controls this subdomain. Evidence:

• Homepage capture: no company name, licence number, terms page or contact details present.
• Hosting: served from AS16509 (AMAZON-02, United States).
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject Netlify, Inc, valid to 2027-03-19.
• Broker reputation dataset: no match found.

What to Verify Next

Anyone who received this address through an email, message, advertisement or QR code should establish independently who sent it and why it points to a hosting-platform subdomain. The proper route is to contact the claimed organisation through contact details published on its own verified website or in prior official correspondence, not through the message that supplied the link. If the address was presented as a login or account portal, the organisation's official domain should be confirmed from an independent source before any interaction. Organisations that suspect the address misuses their brand can report it to the hosting platform's abuse desk and to the relevant security vendors. Evidence:

• The address presents no identifiable operator, so the sender's channel is the only route to attribution.
• The sandbox found hidden credential-capable forms, which makes confirmation of the official portal address the priority step.
• The hosting platform's own abuse process is the appropriate escalation path for a subdomain it serves.

Summary Verdict

The evidence points to an elevated-risk address. Convergent external detections and concealed credential-capable behaviour outweigh the technically sound transport layer. The site's legitimacy is unestablished, and sensitive interactions are unsafe.

Infrastructure Integrity

The site is served through AWS-based content-delivery edge infrastructure operated by the hosting platform, over a valid, unexpired certificate with a recognised issuer. All four observed addresses are edge nodes. The origin server was not observable, so independent verification of the underlying host is not possible, and edge-only visibility can mask rapid content swaps. This protective infrastructure is a mitigating factor only. It is shared by many unrelated tenants and does not offset the external threat detections.

Closing Assessment

The address should not be used for login, credential entry, payments or any financial interaction, and no information should be submitted to it. At most, it may be viewed passively. Anyone who has already entered credentials or personal data should change the affected passwords promptly and report the address to the security team or service provider concerned.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.