Is portal-moonshot-yaw.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a hosted placeholder page rather than an operating service. Its root address on a free subdomain of a popular site-hosting platform returns a generic "Site not found" error, which says the visited address does not exist on that platform and invites visitors to build and deploy their own site. The page offers no products, services, contact details or monetisation, so its apparent purpose cannot be established from its content. The address itself is crafted to resemble a portal-style service name.

Scam/Impersonation Risk

Confirmed contradictions are present, and they come from reputation sources rather than from anything the page says. Multiple independent threat-intelligence engines currently flag the address as malicious, including a tier-one security vendor, and the combined result amounts to a confirmed blacklist listing. A phishing-known indicator also fired against the address. The page content shows no impersonation, and no conflicting legal identities appear because the page carries no identity content at all. However, the address was flagged as a probable lookalike of the hosting platform's own name. That makes a brand-impersonation attempt a plausible reading, though not a confirmed one. Behavioural testing adds a discrepancy. The visible page is an inert error notice, yet three of three sandbox runs detected hidden forms and password-type fields. Page structure also changed heavily after interaction, with several thousand DOM mutations. A page that shows nothing but also carries concealed credential-capture elements is consistent with a cloaked or staged phishing page, or with a placeholder swapped in and out. Four abuse reports exist for one of the network addresses serving the site. They apply to a shared cloud address and therefore carry less weight against this specific site, but they do not offset the threat detections. The domain was also created only days before analysis, which fits throwaway infrastructure. Evidence:

• Homepage: a 404 "Site not found" placeholder with no forms, login prompts or contact artifacts visible to a reader.
• Sandbox behaviour: hidden forms in 3 of 3 runs, 3 password-type forms detected, and a maximum of 4,132 DOM mutations after interaction.
• Domain provenance: registered about 15 days before analysis (~0.04 years old), with 1 archive snapshot in 2026 (first and last seen 2026-10-04, 1 year tracked).
• Network reputation: 4 abuse reports against the shared edge address 2a05:d014:58f:6200::258, which is classified as shared provider infrastructure.

Regulatory Verification Notes

No legal, terms, privacy, about or contact pages exist on the site, and no company name, licence or registration number is published. With no business content, no regulatory claim can be assessed. The missing disclosures are a content gap but not by themselves proof of wrongdoing. Ownership details are incomplete and the operator cannot be tied to any real-world person or brand, so legitimacy cannot be inferred. No third-party broker or regulator listing was matched. The valid certificate on the site was issued to the hosting platform, not to the operator of this subdomain. It confirms encrypted transport only and says nothing about who runs the site. Evidence:

• Homepage: no corporate name, licence, address or policy pages, and no search metadata such as a title or description.
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Broker reputation: no matching entry in third-party broker datasets.

What to Verify Next

Any interaction should be preceded by establishing who actually operates this address. Anyone who received this link in an email, message or advertisement should treat the sender as unverified and confirm the intended destination through an independent, offline channel. The address should be compared character by character with the official address of the organisation it is claimed to represent. Anyone who has already entered credentials here should change them immediately and enable multi-factor authentication. Organisations should report the address to the hosting platform's abuse desk and to their internal security team so that the content can be reviewed and, if warranted, taken down. Official support and contact channels should be confirmed only through the genuine brand's own website, never through links supplied alongside this address. Evidence:

• Homepage: the page itself names no organisation, so the claimed identity must come from whoever supplied the link.
• Address structure: a free subdomain of a public hosting platform, which any customer can create without identity checks.
• Sandbox behaviour: concealed password-type fields were detected despite none being shown, which is the main reason credentials should not be entered.

Summary Verdict

The assessment is critical and clearly cautionary. Confirmed threat-intelligence detections and an anomalous behavioural profile are not offset by the neutral appearance of the visible page or by the platform's valid encryption. The site's operator is unidentified, and the evidence does not support treating it as a legitimate service.

Infrastructure Integrity

The site is served through Amazon-operated edge infrastructure, which is the hosting platform's own delivery layer. All four observed addresses are edge nodes, and the true origin was not observable. That limits independent verification of where content is hosted and makes it easier to swap content without a visible change in hosting. The protection is a mitigating factor only. It does not counter the threat detections.

Closing Assessment

The site should be treated as unsafe for sign-in, credential entry and any financial or payment activity. At most it may be viewed passively, and nothing should be downloaded from it.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.