Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
portal-moonshot-2cf.netlify.app is low-trust and potentially risky.
| What this site appears to be | Default Netlify 404 'Site not found' error page. No site content, forms, links, or business information is available for analysis. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 3 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 2 reports; shared hosting inflates reports | Clear |
| Domain age | 15 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20261 snapshot | Clear |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a hosted subdomain on a public site-deployment platform. Its homepage currently shows only the platform's default "Site not found" error page, with no products, pricing, forms, legal text, contact details or business claims. No monetization model or operator can be inferred from what it presents. Its purpose is therefore unclear. It looks like a placeholder or an abandoned or not-yet-published deployment, and its name styles it as a "portal" under a "moonshot" label.
Scam/Impersonation Risk
The assessment is a clearly cautionary one, driven by external threat intelligence rather than by anything the page says. Several independent reputation sources currently flag the address as malicious. One tier-one security vendor is among those detections, and the combined detections amount to a confirmed blacklist listing. The site is not shown to be impersonating a specific brand, phishing, or carrying conflicting legal identities. However, the address closely mimics the hosting platform's own naming pattern. The page-level analysis therefore raised a brand-lookalike suspicion that the reputation findings reinforce. Abuse reports exist against one of the delivery addresses, but they sit on shared provider infrastructure with no confidence attached. They are discounted and carry no weight against this site.
Behavioural testing showed something the visible page does not explain. Across all three sandbox runs, hidden forms were present, including password-type fields. The page also produced a very large burst of DOM changes after interaction, over four thousand mutations. This contrasts sharply with a static 404 page. It suggests content or form injection that is not apparent from the rendered page, which fits a staging shell that can be swapped into a credential-collection page. No wallet-connection, clipboard-hijack, cloaking or fingerprinting behaviour was observed, and external requests were all to whitelisted destinations.
- The homepage returns the platform's generic 404 notice and contains no content, links or forms of the site's own, so the visible page gives no business context.
- Three of three sandbox runs detected hidden forms with password fields on the homepage. This is inconsistent with a plain error page.
- Domain registered about 13 days before analysis (roughly 0.04 years old). The web archive holds 1 snapshot, first and last seen 2026-10-07, so there is effectively no history to offset the threat detections.
- Three malicious and one suspicious detection were recorded on the domain, including one from a tier-one security vendor.
Regulatory Verification Notes
No legal, licensing, terms, privacy or about pages exist to assess. The site therefore claims no financial or other licence, no registration number and no corporate identity, and no real-world operator can be connected to it. No third-party broker or regulatory-database entry was found, so no reputational signal arises from that source. This is a content gap and does not itself indicate wrongdoing. Only the threat detections described above establish the elevated risk. The valid certificate below confirms encrypted transport, not who operates the site.
- The homepage carries no company name, licence reference, jurisdiction or legal notice.
- TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV validation) to the hosting platform's operating organization, valid to 2027-03-19. The certificate therefore reflects the platform and not an independent operator of this site.
- Served from AS16509 (AMAZON-02 – Amazon.com, Inc., US), registry ARIN.
What to Verify Next
Before any engagement, the party that shared this address should be asked to confirm, through an independent channel, who operates the site and why it is being promoted. The address should be compared against the official domain of any organization it claims or implies a link to. The domain's current threat-intelligence listings should be re-checked later, since a re-deployment could either clear them or add to them. If the site later publishes real content, its legal entity and any claimed licence should be confirmed directly with the relevant registry rather than from on-site statements.
- The only content observed is the platform's default error page, so the site's intended function cannot be confirmed from the site itself.
- The domain is about 13 days old with a single archive capture, so the site has no track record to rely on.
- The brand-lookalike suspicion rests on the domain's close resemblance to the hosting platform's own naming pattern.
Summary Verdict
The available evidence supports a high-risk posture. External threat intelligence lists the address as malicious, the domain is brand new, and the site shows concealed-form behaviour that the visible page does not explain. Nothing positive in the technical profile offsets this. The site is placeholder-like and its operator is unidentified, so there is no basis for treating it as legitimate.
Infrastructure Integrity
The site is delivered through Amazon-operated content-delivery infrastructure. All four observed addresses are edge nodes, and the origin server was not observable. The certificate is valid and the infrastructure is mainstream, which mitigates concerns about the hosting layer. That does not establish who controls the content, and the edge-only visibility means the content behind it could be swapped quickly without any change in the infrastructure. Protective infrastructure cannot offset the external threat detections.
Closing Assessment
The site should not be used for logins, credential entry, payments or any financial interaction. At most it should be treated as read-only, and no files should be downloaded from it. Any link that led here should be treated as unsolicited until the sender is independently confirmed.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS
03 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
05 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
Signals weighed against the site
- AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of portal-moonshot-2cf.netlify.app.
- The request stayed on portal-moonshot-2cf.netlify.app. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2026-10-07. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::259 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.04 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-07 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 3 flagged | AbuseIPDB: 0% confidence, 2 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-2cf.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.