Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
portal-moonshot-0o9.netlify.app is low-trust and potentially risky.
| What this site appears to be | The page is the default Netlify 'Site not found' 404 response, indicating that the requested path or site is not deployed on Netlify. It contains no service description, forms, links, or commercial content. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This hostname is a tenant subdomain on a shared website-hosting platform. At the time of capture, its homepage showed only the platform's default "Site not found" 404 notice, with an internal reference ID and a promotional prompt to build and deploy a site for free. The page carries no products, pricing, forms, links, or business description, so no commercial purpose or operating model can be observed. The portal-style hostname suggests an intended login or account area that was not serving any content when captured.
Scam/Impersonation Risk
Material contradictions are present, and the posture is clearly cautionary. Multiple independent security engines rate the host as malicious, including a tier-one security vendor, and this amounts to a confirmed blacklist listing. The page content gives no counterweight to it. The homepage is a bare platform error page with no company narrative, products, or identity claims that could explain or offset the listing. The sandbox also found a mismatch between the visible page and its behaviour. The visible homepage contains no forms, yet automated sessions detected concealed forms in every run, including password-type fields. The page also produced a very large volume of DOM changes after interaction. Concealed credential fields on a page that visibly offers nothing are consistent with a placeholder that can be swapped or activated for credential collection. No wallet-connection, clipboard-tampering, or cloaking behaviour was observed. A page-level lookalike signal against the hosting platform's own name was also noted, but it is not a confirmed impersonation, and no conflicting legal identities exist because no identity content is published. Taken together, the security detections and the concealed-form behaviour make the host unsuitable for any credential or payment interaction.
- Homepage: shows only the default platform "Site not found" notice, with no forms, links, or commercial content visible.
- Reputation checks: 5 security engines rated the host malicious, including one tier-one vendor, and an external blacklist listing is confirmed.
- Behavioural sandbox: hidden forms with password-type fields were detected in all 3 runs, with 4,130 DOM mutations recorded after interaction on a visibly static page.
- Page analysis: a lookalike similarity to the hosting platform's brand was flagged; no impersonation of a third-party brand was confirmed.
Regulatory Verification Notes
The captured page contains no legal, licensing, terms, privacy, or operator-identity content, so there is nothing on-site against which a licence or registration claim could be tested. No financial-services licence is claimed. The real-world operator behind this subdomain is not independently connected to any brand or person, and the evidence does not establish who controls the content served here. Because the host sits on a shared platform, the encryption certificate is issued to the platform provider rather than to any site operator. It confirms a valid, correctly configured transport layer, but it says nothing about who runs this tenant site. No match was found in third-party broker-reputation data, which is neutral context and neither clears nor condemns the site.
- Homepage: no legal entity name, licence number, regulator reference, or contact details are published.
- Transport encryption: the OV-validated certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19.
- Hosting infrastructure: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
- Broker-reputation lookup: no matching record.
What to Verify Next
Anyone who received this address in an email, message, advertisement, or QR code should confirm through an independent channel, such as a known phone number or the organisation's officially published website, whether that organisation actually operates a portal at this hostname. If the link claimed to lead to a portal or account area, the empty platform error page suggests the content was removed, never deployed, or is being served selectively. A fresh, isolated re-check is advisable before any further interaction, as is a report to the hosting platform's abuse channel if the link arrived unsolicited. No login details, one-time codes, or wallet approvals should be entered on this host in the meantime.
- Homepage: the platform error notice implies the expected content is not currently deployed at this address.
- Behavioural sandbox: concealed password-type forms were detected on a page that visibly offers none, so any later content change should be treated as untrusted.
- Reputation checks: current security detections remain active, so a clean re-scan is needed before any change in handling.
Summary Verdict
The assessment is low trust with elevated risk. Confirmed external security detections are decisive, and the near-empty page offers no legitimate operating context that could offset them. Valid encryption and mainstream hosting are real but secondary signals that do not establish the site's purpose or operator.
Infrastructure Integrity
The site is delivered through Amazon's CDN/WAF layer, and all four observed addresses are edge servers within the same Amazon network. The origin server was not observable, so independent verification of the underlying hosting is not possible, and edge-only visibility can mask rapid content swaps. This protective layer is a mitigating factor only and cannot offset the reputation findings. The small number of abuse reports lodged against one of the shared edge addresses relates to the provider's shared infrastructure and is not attributed to this specific site.
Closing Assessment
The site should be treated as unsuitable for sign-in, credential entry, payments, or any financial or wallet interaction. Any contact should be limited to passive viewing, with nothing downloaded or installed. Anyone who has already entered credentials or approvals on this host should change those credentials promptly and monitor the affected accounts.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH
03 Page content
- The page shows few of the signs expected from a trustworthy operator.Page content
rule:PAGE_TRUST_QUALITY_LOW - The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of portal-moonshot-0o9.netlify.app.
- The request stayed on portal-moonshot-0o9.netlify.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-0o9.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.