--- title: "Is portal-moonshot-0w6.netlify.app a Scam? Trust Score 0/100" source: TrustSniffer type: Website trust & fraud report subject: "portal-moonshot-0w6.netlify.app" verdict: "Critical Risk" title: "Is portal-moonshot-0w6.netlify.app a Scam? Score 0/100" trust_score: 0 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/portal-moonshot-0w6.netlify.app assessed: 2026-10-20 --- # Is portal-moonshot-0w6.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100 ## Verdict **Verdict: Critical Risk, trust score 0/100.** portal-moonshot-0w6.netlify.app shows high-risk / scam indicators. This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-20 by automated analysis. Classification confidence 75%. | Field | Value | | --- | --- | | What this site appears to be | A Netlify 'Site not found' 404 error page. The requested path does not exist on Netlify, the page contains no site content, forms, or links, and it shows no deceptive or sensitive-data behavior. | ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 5 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 1% confidence (AbuseIPDB, 4 reports; shared hosting inflates reports) | Clear | | Domain age | 15 days old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2026 (1 snapshot) | Clear | | Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted | ## The page as captured ![Screenshot of the portal-moonshot-0w6.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-0w6.netlify.app/screenshots/first.png) _What portal-moonshot-0w6.netlify.app served when TrustSniffer captured it on 2026-10-20. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2026. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Security Alert Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution. The site at this address is a freshly provisioned subdomain on the Netlify hosting platform. Its homepage serves only the platform's generic "Site not found" 404 screen, which says the requested path does not exist and invites visitors to build and deploy their own site. It shows no products, branding, forms or links, and no business model can be inferred. It appears to be a placeholder or abandoned deployment slot, not an operating business. ### Scam/Impersonation Risk Contradictory signals are present and severe. Several independent security engines currently flag this host as malicious, and one suspicious verdict was also returned. One of the flags comes from a major tier-one security vendor. This amounts to a confirmed **blacklist** listing. The hostname is a very young, auto-generated subdomain under a shared hosting namespace, and its "portal-moonshot" naming resembles a staging or login-portal label. Rendered in the sandbox, the homepage looks like an inert error screen. The behavioural sandbox nonetheless recorded hidden forms in all three runs, with password-form presence, and about 4,130 DOM mutations after interaction. A static 404 would produce neither. The sandbox also flagged a final-destination mismatch. Together these point to a dormant staging shell that can be switched to credential-harvesting content without notice. The four abuse reports on record apply to a shared provider address, not to this site specifically. They are secondary context only and are not counted as a finding against the site. No conflicting legal identities were observed. The decisive concern is the external threat detections combined with the hidden-form and content-mutation behaviour. Evidence: - Homepage: the visible content is a bare "Site not found" 404 notice with no navigation, claims or contact details, yet the sandbox logged hidden forms in 3 of 3 runs. - Homepage behaviour: 4,130 DOM mutations after interaction, 3 console errors and 36 external requests in a page that visibly contains almost nothing. A destination mismatch was also flagged. - Reputation: 5 malicious and 1 suspicious detections from external engines, including a tier-one vendor. Abuse reports total 4, against a shared hosting address. - Provenance: the domain was first observed on 2026-10-07 (about 13 days old), with a single archive snapshot and 1 year tracked. DNS characteristics are ephemeral and fast-flux-like, with a TTL of about 116 seconds. ### Regulatory Verification Notes The site publishes no legal, about, terms, privacy or contact pages, and it names no operating company, registration number or licensing authority. Its ownership and governance are therefore opaque, and the real-world operator is not independently connected to any identifiable brand or person. The certificate is valid, but it is an organization-validated certificate whose subject is the hosting platform. It attests to the platform, not to whoever controls this subdomain. No third-party broker or regulator record matched this site, and the site claims no licence of any kind. The absence of disclosures is a verification gap and is not by itself evidence of fraud. The external threat detections above are what drive the cautionary assessment. Evidence: - Homepage: contains no company name, address, licence reference or policy pages of any kind. - Hosting: served from AS16509 (Amazon, AMAZON-02, US). - Transport encryption: the TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), with subject organization Netlify, Inc and validity to 2027-03-19. ### What to Verify Next Sensitive interactions should be deferred until an independent party establishes who operates this subdomain and why it is receiving threat detections. The relevant checks are whether the intended owner exists and controls this deployment, and whether the listings have been cleared. If the site is expected to belong to a known organization, its official address should be confirmed through an independent, offline route such as a published corporate directory or a direct call. Any claimed licence should be checked directly with the relevant registry. It should not be taken from this site, which names none. Official support and contact channels should be confirmed independently before any correspondence is initiated. Evidence: - Homepage: no operator, licence or contact information is available to check against, so confirmation has to come from outside the site. - Reputation: the active external detections should be re-checked after any claimed clean-up before the host is treated as safe. - Behaviour: the hidden-form activity should be re-tested if the host's content changes. ### Summary Verdict The overall posture is high-risk and clearly cautionary. Active external threat detections, hidden-form behaviour and heavy post-load page mutation on an unverified, days-old host converge on a site that cannot be treated as trustworthy. The valid certificate and clean-looking rendered page do not offset these signals. The legitimacy of the site and its operator remains unestablished. ### Infrastructure Integrity The host sits behind AWS content-delivery edge infrastructure, and all four observed addresses are edge nodes. The origin server was not observable, so independent verification of the underlying host is not possible. This protective infrastructure is a mitigating factor only. It does not offset the reputation risk, and it can allow content to be swapped quickly behind a stable edge address. The platform-level hosting is mainstream and the transport encryption is valid, but neither speaks to the intent of whoever controls this subdomain. ### Closing Assessment Logging in, entering credentials, making payments or any other financial interaction with this host should be avoided. Any visit should be limited to passive viewing in an isolated environment, and nothing should be downloaded from it. Re-assessment is appropriate only after the external listings are cleared and an accountable operator is independently identified. _Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content. ### 01 External reputation - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`) ### 02 Behaviour in a sandbox - The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`) ### 03 Hosting and network - The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`) ### 04 History in the web archive - The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`) ### 05 Page content - The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`) ### Signals weighed against the site - AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website. ## Identity verification | Field | Value | | --- | --- | | Status | UNVERIFIED | | Identity score | 30/100 | | Identity verification confidence | 50% | - No on-site identity signals detected _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of portal-moonshot-0w6.netlify.app. - The request stayed on portal-moonshot-0w6.netlify.app. It was not redirected to another domain. (Clear) - The earliest public archive of this site is from 2026-10-07. (Clear) - It is hosted on AMAZON-02, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Not available | | Hosting | AMAZON-02 - Amazon.com, Inc., US | | Country | US | | Server IP | 2a05:d014:58f:6200::258 | | Name servers | Not available | | CDN / edge network | Detected (aws) | | Resolved IP addresses | 4 | | Edge IP addresses | 4 | | Likely origin IP addresses | 0 | | SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 | | SSL expiry | 2027-03-19 | | Domain age | 0.04 years (continuous registration) | | Domain expiry | Not available | | Archive first seen | 2026-10-07 | | Archive snapshots | 1 | | Reputation | VirusTotal: 5 flagged \| AbuseIPDB: 1% confidence, 4 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-0w6.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [pump-voting-r1.netlify.app](https://trustsniffer.com/report/pump-voting-r1.netlify.app), a similar name (Critical Risk, 5/100) - [vocal-piroshki-bef531.netlify.app](https://trustsniffer.com/report/vocal-piroshki-bef531.netlify.app), a similar name (Critical Risk, 0/100) - [robinhood-main-dex-gqv.netlify.app](https://trustsniffer.com/report/robinhood-main-dex-gqv.netlify.app), a similar name (Critical Risk, 0/100) - [robinhood-main-dex-fmt.netlify.app](https://trustsniffer.com/report/robinhood-main-dex-fmt.netlify.app), a similar name (Critical Risk, 0/100) - [robinhood-main-dex-eht.netlify.app](https://trustsniffer.com/report/robinhood-main-dex-eht.netlify.app), a similar name (Critical Risk, 0/100) - [robinhood-main-dex-dlr.netlify.app](https://trustsniffer.com/report/robinhood-main-dex-dlr.netlify.app), a similar name (Critical Risk, 0/100) - [robinhood-main-dex-bhp.netlify.app](https://trustsniffer.com/report/robinhood-main-dex-bhp.netlify.app), a similar name (Critical Risk, 0/100) - [pump-voting-g5.netlify.app](https://trustsniffer.com/report/pump-voting-g5.netlify.app), a similar name (Critical Risk, 5/100) - [taklufah.com](https://trustsniffer.com/report/taklufah.com), another site assessed as critical-risk (Critical Risk, 0/100) - [natupele.com.br](https://trustsniffer.com/report/natupele.com.br), another site assessed as critical-risk (Critical Risk, 0/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Stablecoin Freezes, Oct 27, 2026: 7 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-27) - [No Age Distribution Yet for Suspicious Websites](https://trustsniffer.com/blog/no-age-distribution-suspicious-websites) - [How to revoke token approval after a scam site](https://trustsniffer.com/blog/how-to-revoke-token-approval-after-a-scam-site) --- *Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-0w6.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-0w6.netlify.app · assessed 2026-10-20.*