---
title: "Is portal-moonshot-2cf.netlify.app Safe? Risk Report, Score 25/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "portal-moonshot-2cf.netlify.app"
verdict: "Low Trust"
title: "Is portal-moonshot-2cf.netlify.app Safe? Score 25/100"
trust_score: 25
classification_confidence: 75
canonical_url: https://trustsniffer.com/report/portal-moonshot-2cf.netlify.app
assessed: 2026-10-20
---

# Is portal-moonshot-2cf.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

## Verdict


**Verdict: Low Trust, trust score 25/100.** portal-moonshot-2cf.netlify.app is low-trust and potentially risky.

Several risk patterns were present. Do not send money or personal details until you have verified this business another way.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-20 by automated analysis. Classification confidence 75%.

| Field | Value |
| --- | --- |
| What this site appears to be | Default Netlify 404 'Site not found' error page. No site content, forms, links, or business information is available for analysis. |

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 3 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 0% confidence (AbuseIPDB, 2 reports; shared hosting inflates reports) | Clear |
| Domain age | 15 days old (Most scam domains are under a year old) | Risk |
| Web archive | Archived since 2026 (1 snapshot) | Clear |
| Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted |

## The page as captured


![Screenshot of the portal-moonshot-2cf.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-2cf.netlify.app/screenshots/first.png)

_What portal-moonshot-2cf.netlify.app served when TrustSniffer captured it on 2026-10-20. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a hosted subdomain on a public site-deployment platform. Its homepage currently shows only the platform's default "Site not found" error page, with no products, pricing, forms, legal text, contact details or business claims. No monetization model or operator can be inferred from what it presents. Its purpose is therefore unclear. It looks like a placeholder or an abandoned or not-yet-published deployment, and its name styles it as a "portal" under a "moonshot" label.


### Scam/Impersonation Risk

The assessment is a clearly cautionary one, driven by external threat intelligence rather than by anything the page says. Several independent reputation sources currently flag the address as malicious. One tier-one security vendor is among those detections, and the combined detections amount to a confirmed **blacklist** listing. The site is not shown to be impersonating a specific brand, phishing, or carrying conflicting legal identities. However, the address closely mimics the hosting platform's own naming pattern. The page-level analysis therefore raised a brand-lookalike suspicion that the reputation findings reinforce. Abuse reports exist against one of the delivery addresses, but they sit on shared provider infrastructure with no confidence attached. They are discounted and carry no weight against this site.

Behavioural testing showed something the visible page does not explain. Across all three sandbox runs, hidden forms were present, including password-type fields. The page also produced a very large burst of DOM changes after interaction, over four thousand mutations. This contrasts sharply with a static 404 page. It suggests content or form injection that is not apparent from the rendered page, which fits a staging shell that can be swapped into a credential-collection page. No wallet-connection, clipboard-hijack, cloaking or fingerprinting behaviour was observed, and external requests were all to whitelisted destinations.


Evidence:
- The homepage returns the platform's generic 404 notice and contains no content, links or forms of the site's own, so the visible page gives no business context.
- Three of three sandbox runs detected hidden forms with password fields on the homepage. This is inconsistent with a plain error page.
- Domain registered about 13 days before analysis (roughly 0.04 years old). The web archive holds 1 snapshot, first and last seen 2026-10-07, so there is effectively no history to offset the threat detections.
- Three malicious and one suspicious detection were recorded on the domain, including one from a tier-one security vendor.

### Regulatory Verification Notes

No legal, licensing, terms, privacy or about pages exist to assess. The site therefore claims no financial or other licence, no registration number and no corporate identity, and no real-world operator can be connected to it. No third-party broker or regulatory-database entry was found, so no reputational signal arises from that source. This is a content gap and does not itself indicate wrongdoing. Only the threat detections described above establish the elevated risk. The valid certificate below confirms encrypted transport, not who operates the site.


Evidence:
- The homepage carries no company name, licence reference, jurisdiction or legal notice.
- TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV validation) to the hosting platform's operating organization, valid to 2027-03-19. The certificate therefore reflects the platform and not an independent operator of this site.
- Served from AS16509 (AMAZON-02 – Amazon.com, Inc., US), registry ARIN.

### What to Verify Next

Before any engagement, the party that shared this address should be asked to confirm, through an independent channel, who operates the site and why it is being promoted. The address should be compared against the official domain of any organization it claims or implies a link to. The domain's current threat-intelligence listings should be re-checked later, since a re-deployment could either clear them or add to them. If the site later publishes real content, its legal entity and any claimed licence should be confirmed directly with the relevant registry rather than from on-site statements.


Evidence:
- The only content observed is the platform's default error page, so the site's intended function cannot be confirmed from the site itself.
- The domain is about 13 days old with a single archive capture, so the site has no track record to rely on.
- The brand-lookalike suspicion rests on the domain's close resemblance to the hosting platform's own naming pattern.

### Summary Verdict

The available evidence supports a high-risk posture. External threat intelligence lists the address as malicious, the domain is brand new, and the site shows concealed-form behaviour that the visible page does not explain. Nothing positive in the technical profile offsets this. The site is placeholder-like and its operator is unidentified, so there is no basis for treating it as legitimate.


### Infrastructure Integrity

The site is delivered through Amazon-operated content-delivery infrastructure. All four observed addresses are edge nodes, and the origin server was not observable. The certificate is valid and the infrastructure is mainstream, which mitigates concerns about the hosting layer. That does not establish who controls the content, and the edge-only visibility means the content behind it could be swapped quickly without any change in the infrastructure. Protective infrastructure cannot offset the external threat detections.


### Closing Assessment

The site should not be used for logins, credential entry, payments or any financial interaction. At most it should be treated as read-only, and no files should be downloaded from it. Any link that led here should be treated as unsolicited until the sender is independently confirmed.


_Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content.

### 01 External reputation
- Several malware engines flagged this domain. (External reputation `rule:EXT_BLACKLIST_HIGH`)

### 02 Behaviour in a sandbox
- The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`)

### 03 Hosting and network
- The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`)

### 04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`)

### 05 Page content
- The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`)

### Signals weighed against the site

- AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNVERIFIED |
| Identity score | 30/100 |
| Identity verification confidence | 50% |

- No on-site identity signals detected

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of portal-moonshot-2cf.netlify.app.

- The request stayed on portal-moonshot-2cf.netlify.app. It was not redirected to another domain. (Clear)
- The earliest public archive of this site is from 2026-10-07. (Clear)
- It is hosted on AMAZON-02, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::259 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.04 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-07 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 3 flagged \| AbuseIPDB: 0% confidence, 2 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-2cf.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [portal-moonshot-uhv.netlify.app](https://trustsniffer.com/report/portal-moonshot-uhv.netlify.app), a similar name (Low Trust, 25/100)
- [pump-voting-69.netlify.app](https://trustsniffer.com/report/pump-voting-69.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-0ld.netlify.app](https://trustsniffer.com/report/portal-moonshot-0ld.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-wty.netlify.app](https://trustsniffer.com/report/portal-moonshot-wty.netlify.app), a similar name (Low Trust, 25/100)
- [crypto-alp.netlify.app](https://trustsniffer.com/report/crypto-alp.netlify.app), a similar name (Low Trust, 25/100)
- [pump-voting-9s.netlify.app](https://trustsniffer.com/report/pump-voting-9s.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-0o9.netlify.app](https://trustsniffer.com/report/portal-moonshot-0o9.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-d03.netlify.app](https://trustsniffer.com/report/portal-moonshot-d03.netlify.app), a similar name (Low Trust, 25/100)
- [crypto-sni.netlify.app](https://trustsniffer.com/report/crypto-sni.netlify.app), a similar name (Low Trust, 25/100)
- [jup-gate.pro](https://trustsniffer.com/report/jup-gate.pro), another site assessed as low-trust (Low Trust, 28/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [How to revoke token approval after a scam site](https://trustsniffer.com/blog/how-to-revoke-token-approval-after-a-scam-site)
- [Stablecoin Freezes, Oct 26, 2026: 11 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-26)
- [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-2cf.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-2cf.netlify.app · assessed 2026-10-20.*