Is meta-moonshot.com a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

meta-moonshot.com is a recently registered website, presented under a crypto-style "meta moonshot" name, whose commercial purpose and business model could not be established from the evidence gathered. No products, services, yields or operator claims were available to characterise what it offers a visitor.

Scam/Impersonation Risk

The evidence shows confirmed contradictions at the reputation level. Several independent threat-intelligence sources currently flag the domain as malicious or suspicious, and one tier-one security vendor is among them. Together these amount to a confirmed blacklisting. Because the domain is new and is listed, the usual explanation of an established site that has been compromised is less plausible, and the cautionary reading is the proportionate one. No brand impersonation and no conflicting legal identities were observed. The site's observed browser behaviour was benign in the sandbox. It made no external requests, no wallet-connection or drainer activity and no clipboard manipulation. It showed no cloaking and no hidden or externally posting credential forms. This does not offset the external detections. A page that is quiet under automated observation can still be activated later for phishing or malware delivery. The domain's age compounds the concern, because it leaves no track record to counterbalance the listings. Evidence:

• Homepage and domain-level reputation: three security engines rate the domain malicious and two rate it suspicious, including one tier-one vendor. The aggregate external blacklist status is positive.
• Domain provenance: registered 2026-03-17 (~0.61 years old). The web archive holds 18 snapshots, all in 2026 (1 year tracked), with first and last capture on 2026-03-19.
• Homepage sandbox behaviour: three successful runs with stable responses, zero external network calls and zero console errors.

Regulatory Verification Notes

The site discloses no verifiable legal entity, licence or registration through any page that could be assessed, and its operator's real-world identity remains unconfirmed. Registration details show ownership opacity: the registrant record is incomplete, and the domain was registered through the registrar NICENIC International Group. That is an administrative limitation, not an identity contradiction. No third-party broker or regulator record could be matched to the name, so there is no regulatory standing to weigh either way. The reputational detections described above are the decisive factor, not the lack of disclosures. Evidence:

• Registration record: registrar NICENIC International Group Co., Limited. Expiry is set for 2027-03-17, so the registration runs about one year.
• Transport layer: domain-validated TLS certificate issued by YE2, valid to 2026-12-09 with 43 days remaining. DV validation confirms control of the domain only, not the operator's identity.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Third-party broker dataset: no match for the site name.

What to Verify Next

The site should be treated as unsuitable for any sensitive interaction until the external detections are resolved. Anyone with a business reason to engage should first re-check the domain against several independent reputation services and see whether the listings have been delisted or still stand. The sender or channel that directed them to the site should be validated through an independent, offline route, and the official channels of any claimed organisation should be confirmed the same way. Any claimed licence or corporate registration should be confirmed directly with the relevant registry, not through links on the site. Evidence:

• Reputation aggregation: three malicious and two suspicious verdicts are currently recorded, so a re-check should show whether they persist.
• Registration timeline: the domain is about seven months old, with no earlier tracked history to corroborate an established operator.
• Certificate window: the TLS certificate expires within roughly six weeks. Whether it renews cleanly is an additional continuity observation.

Summary Verdict

The overall posture is high risk. Confirmed external threat listings on a very young domain with an unverified operator outweigh the technically clean behaviour observed. The site lacks the independent evidence of legitimacy that would support trust, and it carries an elevated risk of being used for phishing or malware delivery.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and all observed addresses are edge servers. The origin host is not visible, so the actual hosting party cannot be independently verified, and content could be changed quickly without a visible hosting change. This infrastructure is a mitigating factor only. It supplies protective plumbing and does not offset the reputation risk. The valid certificate and clean abuse-report history of the shared edge network say nothing about the operator.

Closing Assessment

The site should be limited to passive, read-only viewing, and ideally avoided. Credentials, logins, wallet connections, payments and file downloads should not be entered or performed, and the domain should be blocked or escalated to the security team where it appears in unsolicited messages.