Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
portal-moonshot-59a.netlify.app is low-trust and potentially risky.
| What this site appears to be | The page is a standard Netlify 404 'Site not found' error screen, indicating the requested path or site is unavailable on Netlify. It contains no service description, forms, links, or commercial content. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 4 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is an unbranded subdomain on a free application-hosting platform. Its homepage currently shows only the platform's generic "Site not found" error screen, with no product, company name, pricing, contact details, or navigation. No business model can be inferred from what it presents, and its apparent purpose is unknown. The subdomain label ("portal-moonshot") suggests a staging, login or customer-portal deployment, but that is not stated anywhere on the page.
Scam/Impersonation Risk
Contradictory signals are present, and they point to an elevated-risk posture. The site is blacklisted: a tier-one security vendor and several aggregated reputation engines flag the domain as malicious, and this reputation signal is decisive even though the visible page is benign. Automated behavioral testing across three separate runs also found hidden forms, including password-type fields, in a page that visibly shows none. The page's content also changed very heavily after interaction. A hidden credential form behind an error-screen facade is a recognised pattern for staged phishing kits, which can show an innocuous page to scanners while holding a login capture ready. The page analysis also flagged a close lookalike relationship to the hosting platform's own name, which fits a site trading on a trusted brand. This is a brand-similarity indicator, not a confirmed impersonation of a named organisation. Four abuse reports exist against one of the shared edge addresses serving the site. Because that address is shared platform infrastructure, those reports cannot be attributed to this site specifically and are context only. No conflicting legal identities were found, since the site presents no identity at all. Evidence:
- Homepage: the visible content is a platform 404 error with no forms, links, or commercial claims, while sandbox runs recorded three hidden forms in all three sessions.
- Behavioral testing recorded roughly 4,130 DOM mutations after interaction, which is unusually heavy for a static error page.
- Threat-intelligence results show 4 malicious detections, including one tier-one vendor, plus an external blacklist hit.
- Four abuse reports apply to a shared platform edge IP and are not attributed to this site alone.
Regulatory Verification Notes
The site gives no legal name, licence, registration number, terms page, privacy policy, or contact channel, because the only reachable content is a hosting error screen. No independent link to any real-world operator or brand could be established, and the site's identity remains unverified. The transport certificate is organisation-validated but belongs to the hosting platform, so it identifies the platform and says nothing about whoever deployed this site. No third-party broker or regulatory-registry match exists for the domain, and none should be read as a clean bill of health. Evidence:
- Homepage: no company name, licence, address, or policy pages are present.
- TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
- Hosted on AS16509 (AMAZON-02 - Amazon.com, Inc., US).
- No broker-reputation match was found for the domain.
What to Verify Next
Anyone who received this address, for example in a message, an invitation, or a "portal" login prompt, should confirm through an independent, offline route that the named organisation actually operates it. The organisation's official website, typed in manually or reached through a bookmark, is the reference for the correct login address. If a message pointed here, its sender should be contacted through a previously known channel. The deployment should be reported to the platform's abuse team and to the impersonated or referenced organisation, if one exists. Evidence:
- Homepage: it offers no verifiable operator, so independent confirmation can only come from outside the site.
- The hosting platform's error screen carries an internal reference ID, which an abuse report can cite.
- Hidden credential-type forms in sandbox runs make any login prompt linked to this address untrustworthy until verified.
Summary Verdict
Available evidence supports an elevated-risk posture. A confirmed blacklist-level reputation signal is combined with concealed credential-form behavior and a brand-similarity flag, and no identity or legitimacy evidence offsets them. The valid certificate and clean page presentation do not change that conclusion. The site should be treated as potentially hostile until independent evidence shows otherwise.
Infrastructure Integrity
The site is served through a major cloud provider's CDN/WAF edge, and all four observed addresses are shared edge nodes. The true origin server was not observable. This protective infrastructure is a mitigating factor only. It cannot offset the external threat detections, and edge-only visibility limits independent hosting verification and can mask rapid content swaps behind the same address.
Closing Assessment
Do not enter credentials, make payments, or provide personal data on this site. Treat any message that directs a visitor here as suspect, and limit any interaction to passive, read-only viewing from a protected environment.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH - The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on.Behaviour in a sandbox
rule:BEHAV_DOM_DIFF_AFTER_INTERACTION
03 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of portal-moonshot-59a.netlify.app.
- The request stayed on portal-moonshot-59a.netlify.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 4 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-59a.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.