---
title: "Is portal-moonshot-59a.netlify.app Safe? Risk Report, Score 25/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "portal-moonshot-59a.netlify.app"
verdict: "Low Trust"
title: "Is portal-moonshot-59a.netlify.app Safe? Score 25/100"
trust_score: 25
classification_confidence: 55
canonical_url: https://trustsniffer.com/report/portal-moonshot-59a.netlify.app
assessed: 2026-10-20
---

# Is portal-moonshot-59a.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

## Verdict


**Verdict: Low Trust, trust score 25/100.** portal-moonshot-59a.netlify.app is low-trust and potentially risky.

Several risk patterns were present. Do not send money or personal details until you have verified this business another way.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-20 by automated analysis. Classification confidence 55%.

| Field | Value |
| --- | --- |
| What this site appears to be | The page is a standard Netlify 404 'Site not found' error screen, indicating the requested path or site is unavailable on Netlify. It contains no service description, forms, links, or commercial content. |

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 4 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 1% confidence (AbuseIPDB, 4 reports; shared hosting inflates reports) | Clear |
| Domain age | Not available (No registration record was returned) | Noted |
| Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted |
| Hosted by | AMAZON-02 (Server in US) | Noted |

## The page as captured


![Screenshot of the portal-moonshot-59a.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-59a.netlify.app/screenshots/first.png)

_What portal-moonshot-59a.netlify.app served when TrustSniffer captured it on 2026-10-20. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.

## Full analysis


### Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is an unbranded subdomain on a free application-hosting platform. Its homepage currently shows only the platform's generic "Site not found" error screen, with no product, company name, pricing, contact details, or navigation. No business model can be inferred from what it presents, and its apparent purpose is unknown. The subdomain label ("portal-moonshot") suggests a staging, login or customer-portal deployment, but that is not stated anywhere on the page.


### Scam/Impersonation Risk

Contradictory signals are present, and they point to an elevated-risk posture. The site is **blacklisted**: a tier-one security vendor and several aggregated reputation engines flag the domain as malicious, and this reputation signal is decisive even though the visible page is benign. Automated behavioral testing across three separate runs also found hidden forms, including password-type fields, in a page that visibly shows none. The page's content also changed very heavily after interaction. A hidden credential form behind an error-screen facade is a recognised pattern for staged phishing kits, which can show an innocuous page to scanners while holding a login capture ready. The page analysis also flagged a close lookalike relationship to the hosting platform's own name, which fits a site trading on a trusted brand. This is a brand-similarity indicator, not a confirmed impersonation of a named organisation. Four abuse reports exist against one of the shared edge addresses serving the site. Because that address is shared platform infrastructure, those reports cannot be attributed to this site specifically and are context only. No conflicting legal identities were found, since the site presents no identity at all. Evidence:

- Homepage: the visible content is a platform 404 error with no forms, links, or commercial claims, while sandbox runs recorded three hidden forms in all three sessions.
- Behavioral testing recorded roughly 4,130 DOM mutations after interaction, which is unusually heavy for a static error page.
- Threat-intelligence results show 4 malicious detections, including one tier-one vendor, plus an external blacklist hit.
- Four abuse reports apply to a shared platform edge IP and are not attributed to this site alone.

### Regulatory Verification Notes

The site gives no legal name, licence, registration number, terms page, privacy policy, or contact channel, because the only reachable content is a hosting error screen. No independent link to any real-world operator or brand could be established, and the site's identity remains unverified. The transport certificate is organisation-validated but belongs to the hosting platform, so it identifies the platform and says nothing about whoever deployed this site. No third-party broker or regulatory-registry match exists for the domain, and none should be read as a clean bill of health. Evidence:

- Homepage: no company name, licence, address, or policy pages are present.
- TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.
- Hosted on AS16509 (AMAZON-02 - Amazon.com, Inc., US).
- No broker-reputation match was found for the domain.

### What to Verify Next

Anyone who received this address, for example in a message, an invitation, or a "portal" login prompt, should confirm through an independent, offline route that the named organisation actually operates it. The organisation's official website, typed in manually or reached through a bookmark, is the reference for the correct login address. If a message pointed here, its sender should be contacted through a previously known channel. The deployment should be reported to the platform's abuse team and to the impersonated or referenced organisation, if one exists. Evidence:

- Homepage: it offers no verifiable operator, so independent confirmation can only come from outside the site.
- The hosting platform's error screen carries an internal reference ID, which an abuse report can cite.
- Hidden credential-type forms in sandbox runs make any login prompt linked to this address untrustworthy until verified.

### Summary Verdict

Available evidence supports an elevated-risk posture. A confirmed blacklist-level reputation signal is combined with concealed credential-form behavior and a brand-similarity flag, and no identity or legitimacy evidence offsets them. The valid certificate and clean page presentation do not change that conclusion. The site should be treated as potentially hostile until independent evidence shows otherwise.


### Infrastructure Integrity

The site is served through a major cloud provider's CDN/WAF edge, and all four observed addresses are shared edge nodes. The true origin server was not observable. This protective infrastructure is a mitigating factor only. It cannot offset the external threat detections, and edge-only visibility limits independent hosting verification and can mask rapid content swaps behind the same address.


### Closing Assessment

Do not enter credentials, make payments, or provide personal data on this site. Treat any message that directs a visitor here as suspect, and limit any interaction to passive, read-only viewing from a protected environment.


_Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content.

### 01 External reputation
- Several malware engines flagged this domain. (External reputation `rule:EXT_BLACKLIST_HIGH`)

### 02 Behaviour in a sandbox
- The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`)
- The page replaced a large part of its own content after loading. (Behaviour in a sandbox `rule:BEHAV_DOM_CHANGE_HIGH`)
- The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on. (Behaviour in a sandbox `rule:BEHAV_DOM_DIFF_AFTER_INTERACTION`)

### 03 Page content
- The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`)

### Signals weighed against the site

- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNVERIFIED |
| Identity score | 30/100 |
| Identity verification confidence | 50% |

- No on-site identity signals detected

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of portal-moonshot-59a.netlify.app.

- The request stayed on portal-moonshot-59a.netlify.app. It was not redirected to another domain. (Clear)
- It is hosted on AMAZON-02, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 4 flagged \| AbuseIPDB: 1% confidence, 4 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-59a.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [crypto-hbe.netlify.app](https://trustsniffer.com/report/crypto-hbe.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-m7v.netlify.app](https://trustsniffer.com/report/portal-moonshot-m7v.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-0uw.netlify.app](https://trustsniffer.com/report/portal-moonshot-0uw.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-gzf.netlify.app](https://trustsniffer.com/report/portal-moonshot-gzf.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-cd8.netlify.app](https://trustsniffer.com/report/portal-moonshot-cd8.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-swa.netlify.app](https://trustsniffer.com/report/portal-moonshot-swa.netlify.app), a similar name (Low Trust, 25/100)
- [crypto-muv.netlify.app](https://trustsniffer.com/report/crypto-muv.netlify.app), a similar name (Low Trust, 25/100)
- [portal-moonshot-88a.netlify.app](https://trustsniffer.com/report/portal-moonshot-88a.netlify.app), a similar name (Low Trust, 25/100)
- [firesidelodge.net](https://trustsniffer.com/report/firesidelodge.net), another site assessed as low-trust (Low Trust, 25/100)
- [buggycarwash.com](https://trustsniffer.com/report/buggycarwash.com), another site assessed as low-trust (Low Trust, 25/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen)
- [Trading Platform Scam: Checking a Blocked Balance](https://trustsniffer.com/blog/trading-platform-scam-checking-a-blocked-balance)
- [Connect a Wallet to a Scam Site: What Happens](https://trustsniffer.com/blog/connect-wallet-to-a-scam-site-what-happens)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-59a.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-59a.netlify.app · assessed 2026-10-20.*