Is moonpicks.vercel.app a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a website operating under the name "moonpicks" as a subdomain on a shared application-hosting platform. The available evidence does not show a clear product, service or business model, so its purpose cannot be established from what a visitor can observe. It is presented only as a standalone web property with no corroborated operator behind it.

Scam/Impersonation Risk

This is the decisive area of concern. Multiple independent security engines currently classify the site as malicious, and the volume of detections is high enough to constitute a confirmed blacklist listing. Several of the most widely relied-upon commercial vendors are among those flagging it. This is a direct third-party reputational finding about the site itself, and it outweighs every neutral or favourable technical signal. No conflicting legal identities and no brand impersonation were observed, and no wallet-connection, clipboard-manipulation or hidden-form behaviour was seen. Even so, the confirmed malicious classification means the site should be treated as hostile until the listings are cleared. One additional signal was reviewed and discounted. A large number of abuse reports exist against an address in the hosting provider's shared delivery network. These reports attach to infrastructure serving many unrelated customers and cannot fairly be attributed to this site, so they are not counted against it. The hostname closely resembles its parent hosting platform, which reflects the shared subdomain structure and is not evidence of impersonation. Evidence:

• Homepage and hosting layer: 15 security engines return a malicious verdict for the domain, including three leading-tier vendors, and an external blacklist flag is active.
• Reputation reconciliation: 90 abuse reports were logged against a shared delivery-network address of a mainstream platform provider. They were assessed as shared-infrastructure noise and discounted.
• Behavioural observation of the homepage: three successful test visits showed no external network calls, no console errors and no wallet-drainer or clipboard-hijack activity.

Regulatory Verification Notes

No licensing, registration or regulatory standing could be associated with this site, and no third-party regulatory or broker record matched it. The real-world operator has not been independently connected to the site, and the ownership picture is opaque. This is a verification and transparency matter. It is not by itself evidence of wrongdoing, but here it compounds the confirmed malicious listings, because there is no identifiable accountable party to resolve them. The site's transport encryption is valid but uses only basic domain-level validation, which confirms an encrypted connection and says nothing about who operates the site. Evidence:

• Transport layer: TLS certificate issued by WR1 (DV), valid to 2026-11-27, with 32 days remaining.
• Hosting layer: served from AS16509 (AMAZON-02 – Amazon.com, Inc., US).
• Regulatory lookup: no broker or regulator record matched the site.

What to Verify Next

Before any engagement, an independent route should be used to establish who operates this property and why it is flagged. Reputable security vendors' own listings for the domain should be checked to see whether the flags are current and what category (malware, phishing or other) they cite. Any contact channel should be confirmed through an independent, offline route and not through the site. If a counterparty directed the visitor here, they should be asked through a separately known channel to confirm the address and their own identity. Evidence:

• Reputation status: current malicious classifications from multiple engines remain active as of this analysis.
• Operator identity: no verifiable operator identity was connected to the site by the analysis.

Summary Verdict

The site carries an elevated, clearly cautionary risk posture. Active malicious classifications from several major security vendors are the decisive factor, and no other legitimacy signal can offset them. Technical hygiene and quiet observed behaviour are mitigating details only. The operator is unidentified, so legitimacy cannot be assumed.

Infrastructure Integrity

The site sits behind a mainstream cloud and delivery-network provider with a valid certificate. All observed addresses are provider edge servers, and the underlying origin was not observable. This is a mitigating factor only. It shows professional hosting, does not show the content is safe, and cannot offset the reputation risk. Shared edge infrastructure also means content can change without any visible change in network location.

Closing Assessment

Read-only, low-stakes viewing at most is the proportionate limit, and only from a protected, isolated browsing environment. Logging in, entering credentials, connecting a wallet, making payments, and downloading files should all be avoided until the malicious listings are lifted and the operator is independently identified.

Signals weighed against the site

• AbuseIPDB: 90 reports on hosting IP 64.29.17.67 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.