---
title: "Is portal-moonshot-2gy.netlify.app Safe? Risk Report, Score 25/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "portal-moonshot-2gy.netlify.app"
verdict: "Low Trust"
title: "Is portal-moonshot-2gy.netlify.app Safe? Score 25/100"
trust_score: 25
classification_confidence: 75
canonical_url: https://trustsniffer.com/report/portal-moonshot-2gy.netlify.app
assessed: 2026-10-20
---

# Is portal-moonshot-2gy.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

## Verdict


**Verdict: Low Trust, trust score 25/100.** portal-moonshot-2gy.netlify.app is low-trust and potentially risky.

Several risk patterns were present. Do not send money or personal details until you have verified this business another way.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-20 by automated analysis. Classification confidence 75%.

| Field | Value |
| --- | --- |
| What this site appears to be | The page is a Netlify default 'Site not found' 404 error page with no service content, forms, links, or commercial activity. Analysis is limited to the error page text. |

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 4 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 0% confidence (AbuseIPDB, 2 reports; shared hosting inflates reports) | Clear |
| Domain age | 15 days old (Most scam domains are under a year old) | Risk |
| Web archive | Archived since 2026 (1 snapshot) | Clear |
| Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted |

## The page as captured


![Screenshot of the portal-moonshot-2gy.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-2gy.netlify.app/screenshots/first.png)

_What portal-moonshot-2gy.netlify.app served when TrustSniffer captured it on 2026-10-20. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on the Netlify hosting platform, with a "portal" and "moonshot" style label. At the time of analysis it served only the platform's stock "Site not found" 404 page. The page tells the visitor that a broken link was followed or a URL does not exist, and it offers a prompt to start building a site on the platform. It presents no products, pricing, services, navigation, or stated operator. No business model is observable, and the site's intended purpose cannot be determined from what it exposes.


### Scam/Impersonation Risk

Contradictory signals are present and are the decisive factor in this assessment. Several independent external threat-intelligence sources currently flag the domain as malicious or suspicious, including one tier-one security vendor, which amounts to a confirmed **blacklist** listing. That listing is not offset by anything visible on the page, because the page contains nothing that could explain or rebut it. The sandbox also recorded concealed form elements, including password-type fields, in every observed session, although the rendered page shows no forms at all. A page that visibly offers nothing but conceals credential-capable forms is a recognised staging pattern for credential harvesting. Its heavy post-interaction page rewriting and its high volume of external requests fit the same pattern. The external destinations contacted were benign and whitelisted, so the concern is the concealed capture surface, not any observed data exfiltration. Two abuse reports exist against a shared Amazon edge address. These are attributed to shared provider infrastructure, carry no confidence weighting, and are discounted here as not specific to this site. The site's label also closely resembles the host platform's default domain naming. This is a soft lookalike signal, not a confirmed impersonation. No conflicting legal identities were observed, and no phishing page was directly confirmed. Evidence:

- Domain registration is roughly 13 days old (about 0.04 years), and the web archive holds a single snapshot dated 2026-10-07, so there is 1 year tracked with no historical continuity.
- The homepage is a 368-character default 404 page with no forms, links, or calls to action, yet the sandbox recorded hidden forms in 3 of 3 runs, with password fields present.
- External engines currently report 4 malicious and 1 suspicious detections, with one tier-one vendor among those flagging the domain.
- The homepage showed about 4,130 DOM mutations after interaction, with roughly 99.6% of requests going to external destinations.

### Regulatory Verification Notes

The site publishes no legal, about, terms, privacy, or contact pages, and it names no operator or registered entity. It claims no license or registration, so there is nothing to verify and nothing that has been verified. The ownership opacity is real here, but it is an administrative gap and not an identity contradiction. The only organisation in the site's transport-encryption certificate is the hosting platform, so the certificate confirms the platform and says nothing about whoever controls this subdomain. The valid certificate is a baseline hygiene factor that does not offset the external threat detections. No third-party broker or regulatory-database record was matched, so no reputational signal from that source applies. Evidence:

- The site is served from AS16509 (AMAZON-02, United States).
- The TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19 (150 days remaining).
- The homepage lists no company name, licensing authority, or registration number.

### What to Verify Next

Any prospective interaction should begin by establishing why the link was supplied and what the intended destination was. The host platform's default error page indicates that the content expected at this address does not exist or was never published. The intended organisation's real address should be obtained through an independent, offline route such as official correspondence, an existing contract, or a regulator's public register. Official support and contact channels should be confirmed the same way. If the site later publishes services or claims a license, that claim should be checked directly with the named registry before any reliance. External listings should be re-checked after any remediation, since a change in page content does not clear them. Evidence:

- The homepage currently exposes no operator, product, or channel that could be validated.
- The external threat listings are current at the time of analysis and have not been withdrawn.
- The concealed form behaviour was reproducible across repeated sandbox sessions, so it is not a one-off artefact.

### Summary Verdict

The posture is elevated risk with high decision severity. Current external threat detections, combined with concealed credential-capable form behaviour on an otherwise empty and very recently created site, outweigh the technically sound transport security and the reputable platform behind it. The evidence supports a clearly cautionary assessment, and it does not support a legitimacy conclusion or any verified link to a real-world operator.


### Infrastructure Integrity

The site is delivered through Amazon-operated edge infrastructure that sits behind the Netlify platform, and the origin server was not observable. This is a mainstream, well-regarded provider, and the infrastructure itself shows no anomalies. It is a mitigating factor only. Because only edge addresses are visible, hosting cannot be independently verified, and content can be swapped quickly behind a stable address. Protective infrastructure therefore does not offset the reputational risk.


### Closing Assessment

At most, the site should be viewed in a read-only capacity. No credentials should be entered, no login attempted, and no payment or financial information submitted. Nothing should be downloaded from it. Any business with the supposed operator should be conducted only through channels confirmed independently of this site.


_Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content.

### 01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`)

### 02 Behaviour in a sandbox
- The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`)

### 03 Hosting and network
- The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`)

### 04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`)

### 05 Page content
- The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`)

### Signals weighed against the site

- AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNVERIFIED |
| Identity score | 30/100 |
| Identity verification confidence | 50% |

- No on-site identity signals detected

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of portal-moonshot-2gy.netlify.app.

- The request stayed on portal-moonshot-2gy.netlify.app. It was not redirected to another domain. (Clear)
- The earliest public archive of this site is from 2026-10-07. (Clear)
- It is hosted on AMAZON-02, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::259 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.04 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-07 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 4 flagged \| AbuseIPDB: 0% confidence, 2 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-2gy.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [portal-moonshot-5ay.netlify.app](https://trustsniffer.com/report/portal-moonshot-5ay.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-avq.netlify.app](https://trustsniffer.com/report/portal-moonshot-avq.netlify.app), a similar name (Low Trust, 25/100)
- [crypto-xft.netlify.app](https://trustsniffer.com/report/crypto-xft.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-t1t.netlify.app](https://trustsniffer.com/report/portal-moonshot-t1t.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-phx.netlify.app](https://trustsniffer.com/report/portal-moonshot-phx.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-x0g.netlify.app](https://trustsniffer.com/report/portal-moonshot-x0g.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-dfb.netlify.app](https://trustsniffer.com/report/portal-moonshot-dfb.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-slb.netlify.app](https://trustsniffer.com/report/portal-moonshot-slb.netlify.app), a similar name (Low Trust, 25/100)
- [ficus.in](https://trustsniffer.com/report/ficus.in), another site assessed as low-trust (Low Trust, 40/100)
- [funnymap.net](https://trustsniffer.com/report/funnymap.net), another site assessed as low-trust (Low Trust, 40/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [No Age Distribution Yet for Suspicious Websites](https://trustsniffer.com/blog/no-age-distribution-suspicious-websites)
- [How to revoke token approval after a scam site](https://trustsniffer.com/blog/how-to-revoke-token-approval-after-a-scam-site)
- [Stablecoin Freezes, Oct 26, 2026: 11 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-26)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-2gy.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-2gy.netlify.app · assessed 2026-10-20.*