Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
portal-moonshot-1nt.netlify.app is low-trust and potentially risky.
| What this site appears to be | Netlify 'Site not found' 404 page indicating the requested site or path does not exist on Netlify. The page has no commercial, login, or content features, so no risk indicators were found. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 6 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 2 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a subdomain on a shared, third-party hosting platform. When visited, it returns only the platform's generic "Site not found" 404 error page. That page offers no products, pricing, account features, or stated operator, so no business model or legitimate purpose can be established from what it shows. The name of the site suggests a "portal", which implies a login or account function that the visible page does not deliver.
Scam/Impersonation Risk
Contradictory signals are present and are the decisive factor in this assessment. The site is blacklisted: an external blacklist hit is confirmed, and several independent security engines classify it as malicious, including at least one top-tier security vendor. The hostname also closely resembles the name of the hosting platform itself, so the analysis suspects a lookalike or brand-impersonation pattern. This is a suspicion rather than a confirmed impersonation, but it matches the reputation hits. The visible content and the underlying behaviour also diverge. The page shown is a static error screen, yet repeated sandbox sessions detected concealed forms, including password-type fields. They also detected a very large volume of page changes after interaction, and heavy external request traffic. A hidden credential-capture surface behind an innocuous error page is a recognised staging pattern for phishing kits. Two abuse reports exist against a network address used by the site. They relate to a large provider's shared infrastructure and are discounted, so they do not add weight to the conclusion. No conflicting legal identities were observed.
- Homepage: the only content is a generic hosting-platform 404 notice with a platform-internal reference ID, and it carries no operator, product, or contact information.
- Homepage behaviour: hidden forms were detected in all 3 of 3 sandbox runs, with password-form elements present and 4,130 DOM mutations recorded after interaction.
- Reputation: 6 security engines flagged the site as malicious, including 1 top-tier vendor, and the external blacklist hit was confirmed.
- Hostname: very high lookalike similarity to the hosting platform's own name, with brand impersonation flagged as suspected.
Regulatory Verification Notes
The site gives no verifiable operator identity. It has no company name, legal terms, privacy policy, or licensing statement, and its ownership and governance details remain opaque. Real-world identity is unverified. Because the page is only a hosting error screen, there is nothing to evaluate for regulated activity, and no third-party broker or regulatory record matched the site. These are transparency limitations and do not by themselves indicate fraud, but here they sit alongside confirmed reputational hits. Some technical hygiene is present: a valid organisation-validated TLS certificate, but it was issued to the hosting platform and not to any independent operator. It therefore says nothing about who runs the site.
- Transport encryption: the TLS certificate is OV-level, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19. It attests to the hosting platform, not to the site operator.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Homepage: no legal entity, licence, registration number, or policy pages are presented.
What to Verify Next
Establish how the address was received and whether the sender can be authenticated, since a lookalike hostname plus hidden credential fields is the typical delivery pattern for phishing campaigns. If the link claims to represent a known brand or service, locate that organisation's official domain independently through a trusted source, such as printed material or a verified account on the platform, and compare it to this address. Confirm any official support or contact channel through that same independent route. Any report that originated from this address should go to the hosting platform's abuse channel and to the organisation being imitated, if one is claimed.
- Hostname: the "portal-moonshot" label does not correspond to any identifiable brand on the homepage.
- Homepage: the page names no organisation that could be checked against a registry.
- Reputation: the confirmed blacklist and malicious-engine verdicts apply to this exact hostname.
Summary Verdict
The site presents a high-risk posture. It is blacklisted, shows a suspected lookalike pattern, and contains concealed credential-type form elements behind an empty error page, and no verifiable identity offsets these indicators. Valid encryption and a mainstream hosting provider are routine properties of the platform, and they do not mitigate the reputational findings.
Infrastructure Integrity
The site runs on shared infrastructure from a major cloud provider, behind a CDN/WAF, and only the provider's edge addresses were observable. The origin server was not visible, which limits independent verification of what actually serves the content. Protective infrastructure of this kind is a mitigating factor only. It does not offset the external threat detections, and the same shared platform can host both legitimate and abusive sites.
Closing Assessment
This address should not be used for login, credential entry, or any financial interaction, and nothing should be downloaded from it. Any contact with it should be limited to passive viewing from an isolated environment. If a message or advert directed a user here, treat that source as suspect until it is independently authenticated.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH - The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on.Behaviour in a sandbox
rule:BEHAV_DOM_DIFF_AFTER_INTERACTION
03 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
Signals weighed against the site
- AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of portal-moonshot-1nt.netlify.app.
- The request stayed on portal-moonshot-1nt.netlify.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::259 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 6 flagged | AbuseIPDB: 0% confidence, 2 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-1nt.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.