Is portal-moonshot-xi2.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a Netlify-hosted subdomain with a generated "portal" style name. When captured, its homepage returned a "Site not found" error page with only a few hundred characters of text. It shows a visitor no product, brand, or service, so no business purpose can be established. Its behavior in a browser suggests it may be a staging or placeholder deployment, or a deployment that has been taken down or repurposed.

Scam/Impersonation Risk

Contradictory signals are present and weigh heavily. The domain is blacklisted: several security engines report it as malicious, including a recognized top-tier endpoint-security vendor, and an external blacklist also lists it. Behavioral testing adds to the concern. Across all three automated visits, the homepage contained concealed form elements and password-entry fields even though it displays only an error message. The page also mutated heavily after interaction, and nearly all of its observed network activity went to external destinations. This is the pattern seen in credential-capture kits that sit behind a neutral facade. The domain name also closely resembles the hosting platform's own namespace, which is consistent with a lookalike. No conflicting legal identities appeared, but none could be established either, so identity contradiction is not the basis of this finding. The listings and the hidden-form behavior are enough to treat the site as high risk for any sensitive interaction. Evidence:

• Homepage: returned a "Site not found" error page with minimal text, yet hidden forms were detected in all three test runs and password fields were present.
• Homepage behavior: about 4,130 DOM mutations after interaction, with external traffic reaching roughly 99.6% of observed request share.
• Reputation: five engines rated the domain malicious and one suspicious, and an independent blacklist feed also lists it.

Regulatory Verification Notes

The captured homepage names no company, operator, license, registration number, or jurisdiction, and it offers no terms, privacy, or contact pages. Because it is an error page, this is a content gap, not a disclosure by the operator. No regulator, broker-reputation database, or third-party registry matched the site, and none could corroborate its identity. The site cannot be tied to any real-world person or brand. Its legitimacy therefore cannot be inferred from its presentation. Its valid certificate and recognizable hosting prove only that the deployment is technically well-formed, not that its operator is trustworthy. Evidence:

• Homepage: no legal entity, address, license, or regulatory reference is displayed.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV validation) to Netlify, Inc, valid to 2027-03-19. The certificate belongs to the hosting platform, not to the site's operator.

What to Verify Next

Any organization that claims to operate this address should be asked to identify itself through a channel it controls, such as its corporate website or a published phone number, and not through this domain. Anyone who received a link to this address by message or email should confirm with the purported sender, by an independent route, that they sent it. Security teams should check proxy and mail logs for earlier visits to this address and reset credentials entered there. If a login page is claimed to exist, its URL should be confirmed only from an official source, not from the link received. Evidence:

• Homepage: the visible content gives no operator or brand to validate against, so confirmation must come from the party that supplied the link.
• Hidden form fields and password inputs on the captured page mean any submission could be sent to unknown external recipients.
• No terms, privacy, or support pages were observed from which to confirm an official channel.

Summary Verdict

The assessment is critical. Confirmed third-party threat detections, together with concealed credential-style forms on a page that otherwise shows nothing, outweigh every technical hygiene factor. No independent identity for the operator is established. The site is not suitable for any interaction involving credentials, personal data, or money.

Infrastructure Integrity

The site is served from Amazon Web Services address space behind a CDN/WAF layer. All four observed addresses are edge nodes, and the origin server could not be seen. This is protective infrastructure with a valid certificate, and it reduces only the technical exposure of the deployment. It does not offset the reputation findings. The edge-only view means hosting cannot be independently verified, and content could be swapped quickly. Four abuse reports exist against one of the shared provider addresses. They apply to shared infrastructure, so they are not necessarily specific to this site, but they were not discounted.

Closing Assessment

At most, the address may be opened for read-only inspection from an isolated, non-production environment. No credentials, personal data, or payment details should be entered, and nothing should be downloaded from it. Anyone who has already interacted with it should change affected passwords and monitor the related accounts. Reporting the address to the hosting platform's abuse channel is appropriate.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.