Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
moonbeam-portal.pages.dev shows high-risk / scam indicators.
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 4 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a single-page "decentralized app" front end on a free, shared-platform subdomain with a portal-style name. Its page title promotes "wallet & dapp support for crypto users." To a visitor it presents itself as a gateway for crypto wallet users, which suggests a wallet-connection or support funnel. The captured content does not show a named product, operator, or business model beyond that framing.
Scam/Impersonation Risk
Contradictory signals are present, and they are decisive. Several independent security engines currently flag the site as malicious. Combined with a confirmed external blacklist entry, this places the site in a confirmed blacklisted state. One tier-one security vendor is among the engines that flag it. The domain is a free subdomain on a shared hosting platform, so the "portal" name borrows the look of an official access point without any verifiable brand behind it. The lookalike similarity to the platform's own domain is high. Wallet and "support" pitches of this kind are a common lure for credential or seed-phrase capture. No on-site impersonation of a specific named brand and no conflicting legal identities were observed, so the concern rests on the reputation and listing evidence. Automated sandbox runs on the homepage showed no wallet-drainer behavior, no clipboard manipulation, no hidden forms, no external form posts, and no cloaking. The page did rewrite a large part of its own structure after interaction. That is consistent with a script-driven interface that can change what the visitor is shown, and the clean sandbox result does not offset the external detections. Evidence:
- Homepage: the page title markets "wallet & dapp support for crypto users," a positioning aligned with wallet-connection lures.
- External reputation: 4 engines rate the site malicious and 1 suspicious. A confirmed blacklist entry exists, and one tier-one vendor flags it.
- Homepage behavior: 1,187 DOM mutations after interaction, with no external network activity or wallet-drainer behavior observed across 3 successful sandbox runs.
- Domain: a free shared-platform subdomain with a high lookalike similarity to the platform's own domain.
Regulatory Verification Notes
The captured homepage does not establish a legal entity, licensing status, or regulatory registration. The operator's real-world identity is not independently established, and the domain registration reveals no accountable party, which amounts to ownership opacity. This is a verification gap and not an identity contradiction. A wallet-oriented service of this kind would normally be expected to state who operates it and under what authority, and the page does not. No third-party broker-reputation record matches the site, so there is no regulatory or broker-level signal either way. The valid transport encryption and the established hosting provider are only baseline hygiene and do not support legitimacy. Evidence:
- Homepage: no named operator, registered company, or license reference is disclosed.
- Transport encryption: TLS certificate issued by WE1 (domain-validated only), valid to 2027-01-11, so it confirms an encrypted connection but not who runs the site.
- Hosting: served from AS13335 (Cloudflare, Inc., US).
- Broker reputation: no matching record in the broker-reputation dataset.
What to Verify Next
Any contact with the site should start from independent confirmation of who operates it. Anyone told to visit this address by a message, advertisement, or "support agent" should trace that referral back to its source. The official website of the wallet or service the page claims to support should be reached by typing or bookmarking its known address, not through this link. Any claim of regulation should be checked directly in the relevant public registry. Official support channels should be confirmed through an independent, offline route. Evidence:
- Homepage: the "wallet & dapp support" framing implies affiliation with unnamed wallets or services, and nothing on the page confirms it.
- Reputation: the blacklist entry and engine detections give a concrete reason to treat any inbound referral to this address as suspect.
- Identity: no operator or regulator reference on the page can be cross-checked.
Summary Verdict
The overall posture is high-risk. Active external threat detections and a confirmed blacklist entry outweigh the technically clean behavior observed in the sandbox. The site's identity is unestablished, and nothing in the evidence supports treating it as legitimate.
Infrastructure Integrity
The site sits behind Cloudflare's CDN and web application firewall, and all observed addresses are edge servers, so the origin host is not visible. This is a mitigating factor only. It shows competent delivery infrastructure, but it also prevents independent hosting verification and can mask rapid content changes. It cannot offset the reputation risk.
Closing Assessment
The site should be limited to viewing at most. No wallet connection, login, credential or seed-phrase entry, or financial transaction should be attempted, and nothing should be downloaded from it. Anyone who has already interacted with it should treat any connected wallet or entered credentials as exposed.
Written analysis generated 2026-10-25 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, registration and ownership, behaviour in a sandbox.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
03 Behaviour in a sandbox
- The structure of the page changed sharply while it was loading.Behaviour in a sandbox
rule:BEHAV_DOM_DENSITY_SPIKE
Identity verification
| Status | UNKNOWN |
|---|---|
| Identity score | 50/100 |
| Identity verification confidence | 30% |
- AI page analysis unavailable (page captured; identity not AI-verified)
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of moonbeam-portal.pages.dev.
- The request stayed on moonbeam-portal.pages.dev. It was not redirected to another domain. Clear
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:310c::ac42:2c86 |
| Name servers | Not available |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2027-01-11 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 4 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about moonbeam-portal.pages.dev at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.