Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
portal-moonshot-c23.netlify.app shows high-risk / scam indicators.
| What this site appears to be | The page is a Netlify 'Site not found' 404 error screen indicating that the requested path or site is not deployed. It contains no service, product, login, or financial content. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 2 reports; shared hosting inflates reports | Clear |
| Domain age | 15 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20261 snapshot | Clear |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This hostname is a subdomain on a public site-hosting platform, and it currently returns that platform's generic "Site not found" error page. The page has no products, services, branding, login or payment content, so no business purpose or operator can be inferred from what it shows a visitor. It reads as a placeholder or an undeployed or removed project, not a functioning commercial website.
Scam/Impersonation Risk
This site is blacklisted by multiple independent threat-intelligence sources. Several security engines flag the hostname as malicious, and one more flags it as suspicious. At least one of the engines flagging it is a tier-one security vendor. This is a confirmed contradiction. It sits at odds with the site's visible content, which is a benign-looking hosting error page. The detections do not say which category of threat was identified, and the evidence does not show whether this is phishing, malware or something else. The listing is decisive on its own terms. Behavioral testing also found concealed interface elements that a 404 page has no reason to carry. Hidden forms, including password-type fields, appeared in every test run. The page also made a large volume of external requests and showed heavy page rewriting after interaction. Together these are consistent with content that is swapped in or revealed after load, which would fit a credential-collection kit. No cloaking, wallet-drainer or clipboard-hijack behavior was observed. No legal-entity conflicts or impersonation of a specific third-party brand were confirmed. The hostname's resemblance to its hosting platform is explained by the platform's own error template. The two abuse reports on record apply to a shared platform address and are discounted as infrastructure noise. They do not add to this site's risk.
- Homepage: the page shows only a platform 404 notice with no navigation, forms, products or contact details. It still contains concealed forms with password fields in all three behavioral runs.
- Behavioral analysis of the homepage: 36 external network requests (21 external POSTs, 15 external XHR/fetch), with up to 4,130 page mutations after interaction.
- Domain provenance: the hostname is about 13 days old (first observed 2026-10-07). The web archive holds 1 snapshot (2026), a span of 1 year tracked.
- Reputation: 5 engines report the hostname as malicious and 1 as suspicious, against 53 harmless verdicts, and the external blacklist flag is confirmed.
Regulatory Verification Notes
The site presents no legal, terms, privacy, about or contact pages. It names no operating company and claims no licence or registration, so it makes no regulatory claims that could be checked. The site's actual operator is unidentified, and the weak ownership signals are consistent with that. Ownership opacity is an administrative limitation here and not an identity contradiction. The practical consequence is that no accountable party can be tied to the hostname. A valid, organisation-validated certificate was observed, but it is issued to the hosting platform, not to any independent operator. It therefore says nothing about who runs this site. No third-party broker or regulatory-database entry matches the site, so there is no regulator-side signal in either direction.
- Legal and identity pages: none exist. The homepage contains no company name, licence number or jurisdiction.
- TLS certificate: issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV validation) to Netlify, Inc, valid to 2027-03-19 (about 150 days remaining).
- Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), registry ARIN.
- Third-party broker lookup: no match found.
What to Verify Next
Before any interaction, the party who directed the user to this address should be asked, through an independent and previously trusted channel, who operates it and why it is meant to be used. If the address arrived in a message, advertisement or social post, the sender's identity and the claimed organisation should be confirmed through that organisation's officially published channels. Any genuine service the link claims to represent should be reached by typing its known address directly, not by following this link. If a user has already entered credentials or payment details here, the affected passwords should be changed and the relevant provider notified. The hostname can also be reported to the hosting platform's abuse team, which can confirm whether the project is still deployed.
- Homepage: no operator, product or contact is stated, so provenance cannot be established from the site itself.
- Network behavior: external requests dominate the site's traffic (about 99.6% at peak), so any data submitted could leave the originating hostname.
- Domain provenance: a 13-day-old hostname with a single archive capture provides no history that could corroborate a legitimate prior use.
Summary Verdict
The overall posture is high risk. Confirmed external threat detections are decisive, and no legitimacy evidence offsets them. The identity of whoever controls the hostname remains unverified, and the very young, thinly documented footprint gives no history to counter the detections. The site should be treated as hostile until the detections are cleared by an independent party.
Infrastructure Integrity
The site is delivered through Amazon's content-delivery and web-application-firewall layer. All four observed addresses belong to edge servers, and the origin server is not observable, so hosting cannot be independently verified. That edge-only visibility also makes it easier for content to be swapped quickly without any visible change in infrastructure. The platform's protections and a valid certificate are mitigating factors only and do not offset the reputation risk. DNS behavior shows short-lived, fast-rotating characteristics that are typical of an ephemeral deployment.
Closing Assessment
Account login, credential entry, payment and any file download should be avoided entirely. At most, the address can be viewed passively, ideally in an isolated environment. Security teams may wish to block it and monitor for related lookalike hostnames.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS
03 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
05 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
Signals weighed against the site
- AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of portal-moonshot-c23.netlify.app.
- The request stayed on portal-moonshot-c23.netlify.app. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2026-10-07. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::259 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.04 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-07 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 0% confidence, 2 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-c23.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.