Is portal-moonshot-zh5.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a bare Netlify "Site not found" error screen on a free-hosting subdomain with a portal-style name. The page tells the visitor that the address does not exist on the platform, links to the host's troubleshooting guide, and offers a "Start building" call to action. It describes no products, services, pricing, or company, so its apparent purpose and business model cannot be determined from the page.

Scam/Impersonation Risk

The decisive concern is external reputation. Multiple independent security engines currently classify the hostname as malicious, including a tier-one security vendor, and it is blacklisted by external threat-intelligence sources. That confirmed listing is the contradiction that sets the risk posture. The page content does not explain it. The homepage is an inert error screen with no login prompt, brand claims, or solicitation. The mismatch between this blank front and the external detections is itself significant. A dormant or placeholder address that is already flagged this early suggests the hostname was provisioned for a purpose the visible page does not reveal. The hostname's "portal" naming and the closeness of the page's branding to the hosting platform's own were treated as caution indicators only. No impersonation of a specific third-party brand was confirmed, and no phishing verdict exists. Behavioral testing sharpens the concern. Across all three sandbox runs the page generated concealed form elements, including password-type fields, even though no form is visible to a visitor. It also produced an unusually large burst of DOM changes after interaction, which a static 404 page should not produce. These traits are consistent with a template or kit that can be swapped in behind the error screen. They are not proof of intent. Two abuse reports exist against a network address used by the site. They relate to a shared provider address rather than to this site specifically, so they were discounted and do not drive the conclusion. No conflicting legal identities appear, because the page names no entity at all. Evidence:

• Homepage: a hosting-provider 404 "Site not found" message with no service description, forms, social links, or business claims.
• Sandbox behavior on the homepage: hidden forms with password fields were detected in every run, along with heavy post-interaction page mutation, despite the page presenting as static.
• Domain provenance: first observed roughly 16 days ago, with a single web-archive snapshot (2026) and one year tracked, so there is no history of legitimate use.
• External reputation: several engines flag the hostname as malicious; the abuse reports against the shared provider address were discounted.

Regulatory Verification Notes

The site publishes no legal, terms, privacy, about, or contact pages, and it claims no licence, registration number, or corporate identity. Nothing on the page connects it to any real-world operator, so its identity remains unverified. With no regulated activity advertised, the absence of a licence is a disclosure gap rather than evidence of misconduct. Any later content that offers financial, trading, or payment services would need that gap closed before it could be taken at face value. No third-party broker or regulatory-database match exists for the hostname. The valid transport encryption and the stable page responses confirm only that the host is operational. They do not indicate who runs the site or that it is legitimate. Evidence:

• Homepage: no company name, licence, jurisdiction, or legal documentation appears.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV) to Netlify, Inc, valid to 2027-03-19. The certificate belongs to the hosting platform, not to the site operator.

What to Verify Next

Anyone who reached this address through a message, advertisement, or referral should confirm through an independent route, such as the sender's known official website or a phone number from an unrelated source, that the sender actually uses this exact hostname. If the sender cannot confirm it, the link should be treated as unrelated to them. The hosting platform's abuse-reporting channel is the appropriate route for reporting the address, since the platform controls whether the site stays published. If content later appears claiming financial or regulated services, the stated licence should be checked directly against the relevant regulator's public register before any engagement. Official support and contact channels should be taken only from the organisation's independently known primary domain. Evidence:

• Homepage: it reveals no operator, so the origin of any link pointing here cannot be confirmed from the site itself.
• External reputation: the current malicious classification means a re-check is warranted only if the listing is later cleared.
• Page content: the "Start building" prompt and the support guide link point to the hosting platform, not to any business.

Summary Verdict

The site sits in an elevated-risk posture. A confirmed external blacklisting and concerning concealed-form behavior outweigh the neutral appearance of the error page. Its identity is unverified, and it has no independent history that would offset the detections. The assessment is cautionary and security-forward.

Infrastructure Integrity

The site is delivered through AWS edge infrastructure. All four observed addresses are edge nodes in the Amazon network, and the origin server was not observable. This is a mitigating factor only: it is a mainstream, well-run platform, and it reduces the chance of direct hosting abuse. However, edge-only visibility prevents independent verification of what actually sits behind the address, and it can mask rapid content swaps. The protection cannot offset the reputational risk established by the external detections.

Closing Assessment

Passive viewing of the error page carries limited exposure. Logging in, entering credentials, or making any financial or payment interaction on this address should be avoided. The link should be dropped, and any party that supplied it should be asked to confirm their official address through a separate, trusted channel.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.