Is portal-moonshot-y5b.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a hosting-platform subdomain with a randomly generated name. It currently serves only the generic "Site not found" error page of the Netlify hosting service. The page has no branding, products, forms, links, contact details or legal information. No business model or service is visible. The subdomain is presented as a "portal", but no operator or purpose is stated.

Scam/Impersonation Risk

Contradictory signals are present, and they support a clearly cautionary posture. The address is blacklisted by external threat-intelligence sources, and several independent detection engines classify it as malicious. The page-analysis layer also flags the domain as a close lookalike of the legitimate hosting platform's own domain, which is a known pattern for staging phishing or credential-harvesting content behind a trusted-looking name. The visible page is an inert error screen. However, automated sandbox runs repeated the same behaviour: hidden forms, including password-type fields, were present in the document even though nothing is shown to a visitor. The page also changed heavily after interaction, with thousands of DOM mutations on a page that otherwise holds about 360 characters of text. Content that is invisible by default and then changes on interaction is inconsistent with a genuine "not found" page. It suggests a latent or cloaked login surface that can be switched on later. No conflicting legal identities were found, because no legal identity is published at all. Four abuse reports exist against an address on the shared hosting infrastructure. They apply to the provider's shared network and are not specific to this site, so they are a soft reputational signal and not independent proof of wrongdoing. Evidence:

• Homepage: shows only the default platform 404 message, with no service content, branding or contact channel.
• Sandbox behaviour (three runs): hidden forms with password fields detected in every run, and very large DOM changes after interaction.
• External reputation: the domain is listed by blacklist sources, and multiple engines return malicious verdicts.
• Domain provenance: registered about 13 days before analysis (~0.04 years old); web archive holds 1 snapshot, in 2026 (1 year tracked).

Regulatory Verification Notes

The site has no legal, terms, privacy, about or contact pages. It names no operator, company, licence or registration number. The page therefore provides nothing that connects it to a real-world business or person, and identity remains unverified. Governance and ownership are opaque. Because the page is an error screen, this reflects the absence of any content and is not a deliberate omission. It is a verification gap in itself and does not prove deception. No regulated status is claimed, and no third-party broker record exists for the domain. The domain falls under the platform's shared namespace, so the platform operator controls only the infrastructure and says nothing about the site's operator. Because the domain is so recent, no track record exists to offset the threat listings. Evidence:

• Legal and identity pages: none exist, and no licence or registration claim appears anywhere on the site.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: OV TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19. It is the hosting platform's certificate and does not vouch for the site's operator.

What to Verify Next

No sensitive action should proceed until the operator is identified through an independent route. If this address reached a user through a message, advertisement or referral, the sender should be asked to confirm the correct destination through a channel known to be genuine, and the link's origin should be treated as suspect. Any organisation claiming to run a "portal" here should be located through its own official, independently sourced website and contact details. Its legal name and any licence should then be checked in the relevant public registry. Security teams may wish to report the address to the hosting platform's abuse desk, so that the operator can be identified and the hidden-form behaviour reviewed. Evidence:

• Homepage: states no operator, product, or contact route that could be checked.
• Sandbox behaviour: the hidden password-type forms indicate a login surface that must be attributed to a known organisation before any use.
• External reputation: the active listings should be re-checked after any remediation or change of content.

Summary Verdict

The assessment is critical. Confirmed external threat listings, repeated hidden credential-form behaviour, a lookalike domain pattern and a very recently created domain converge on a high-risk posture. The only positive signals are standard transport encryption and a stable response, which do not offset them. The site's operator and purpose cannot be established.

Infrastructure Integrity

The site is served through Amazon's content-delivery and web-application-firewall edge. All four observed addresses are edge servers, and the origin server was not observable. This protection is a mitigating factor only and does not show that the content is legitimate. Edge-only visibility prevents independent verification of the real hosting and allows content to be swapped quickly behind the same address. The abuse reports mentioned above attach to shared provider addresses and do not by themselves implicate the site's operator.

Closing Assessment

Treat the site as high-risk. It should not be used for login, credential entry or any financial interaction. Any visit should be passive and read-only, preferably from an isolated environment. Block-list or report the address within organisational controls until its operator is identified and the threat listings are cleared.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.