Verdict
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
portal-moonshot-je0.netlify.app shows high-risk / scam indicators.
| What this site appears to be | The page shows a Netlify 'Site not found' 404 error with a link to Netlify support and a 'Start building' call to action. It contains no product, service, company, or contact information, so the site's purpose cannot be determined. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 5 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | 15 days oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 20261 snapshot | Clear |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a subdomain on a public site-hosting platform. When visited, it serves only the platform's generic "Site not found" error page, with a link to the platform's troubleshooting guide and a "Start building" prompt. It presents no products, services, company details, or contact information, so no business model or purpose is visible. The page's own text suggests the site was never deployed, or that the visited path is not mapped to published content.
Scam/Impersonation Risk
This is a cautionary assessment. The site has contradictory reputational signals: it appears on an external blacklist, and several independent security engines classify it as malicious, including at least one major, tier-one engine. A page that shows no content yet draws these detections is consistent with a placeholder or staging address held for later use, a pattern often seen before a site is switched to a deceptive or credential-harvesting purpose. This is an inference from the combined signals, not a confirmed finding. No conflicting legal identities and no confirmed phishing page were observed. The automated analysis did raise a brand-resemblance flag against the hosting platform's own domain name. The site is a subdomain of that platform, so this is more likely a naming artefact than deliberate impersonation. Behavioural testing also found hidden form elements, including password-type fields, in every test run, although the visible page shows no form. The page also produced very large DOM changes after interaction and heavy outbound request activity, and the final destination did not match the expected one. Together these point to content or scripts that the static page does not reveal. The infrastructure-abuse reports (four) attach to a shared network address used by many tenants, so they say little about this site's operator specifically. They do not offset the blacklist and detection signals.
- Domain registration: the domain was registered in 2026 and is about 13 days old, so it has no established history.
- Web-archive depth: 1 snapshot in total, all from 2026 (1 year tracked), so there is no meaningful prior record.
- Homepage behaviour: all 3 sandbox runs found hidden forms. Password-type fields were present, and 4,130 DOM mutations followed interaction.
- Reputation: 5 security engines rated the domain malicious and 1 rated it suspicious. This sits alongside an external blacklist listing.
Regulatory Verification Notes
The only page available is the platform error screen. It names no operating company and no registered address, and it claims no licence, registration, or regulatory authority. These are content gaps on the site itself, and they are verification points rather than evidence of wrongdoing. The real-world operator cannot be independently tied to any brand or person, and ownership is opaque. This is an administrative limitation and not an identity contradiction. No third-party broker or regulator record corresponds to this domain, so no regulated status can be assumed. The valid certificate shows that the hosting platform's own certificate is in place, but not who runs this particular site. It confirms encrypted transport only and says nothing about the operator's legitimacy.
- Homepage: the page lists no company name, licence, registration number, or contact details.
- Hosting: the site is served from AS16509 (Amazon), under the hosting platform's tenant infrastructure.
- Transport encryption: the TLS certificate was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 at OV level, with the hosting platform as subject organisation. It is valid to 2027-03-19.
What to Verify Next
The first step is to establish where the link came from and what it was meant to open. The intended operator should confirm the exact web address through an independent route, such as a known phone number or an official channel reached without using this site. If the link was received in a message, advertisement, or by email, the sender's identity should be confirmed outside that message. The same operator should be asked to confirm that no portal login is expected at this address. If a financial or account service is claimed, its licence status should be checked directly with the relevant regulator's public register, and the official contact channels should be confirmed independently.
- Homepage: it provides no usable contact or identity information, so verification cannot rely on the site.
- Reputation findings: the blacklist and detection signals justify confirming provenance before any further engagement.
- Account context: the "portal" naming of the domain suggests a login-style purpose that the page itself does not show.
Summary Verdict
Available evidence supports a high-risk posture. The site has no visible legitimate purpose or identifiable operator, and independent security sources flag it. Hidden-form behaviour and a very recent registration add to this assessment. Nothing in the evidence offsets these signals strongly enough to support a more favourable view.
Infrastructure Integrity
The site sits behind the hosting provider's content-delivery and edge layer. All observed addresses are edge addresses under a major cloud provider, and the origin server could not be observed. This is a mitigating factor only. It shows the site is on mainstream, well-maintained infrastructure, but it does not establish who operates the site. Edge-only visibility also prevents independent verification of the hosting and allows content to be swapped quickly. The protective infrastructure cannot offset the reputational risk.
Closing Assessment
The site should be treated as read-only at most. No login, credentials, payment details, or wallet interactions should be entered or approved, and nothing should be downloaded from it. Anyone who received this address unsolicited should disregard it and report it to the party that supplied it. Any dealings with the claimed operator should go through a separately confirmed channel.
Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS
03 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D
04 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new.History in the web archive
rule:ARCH_PEN_YOUNG_AND_SPARSE
05 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of portal-moonshot-je0.netlify.app.
- The request stayed on portal-moonshot-je0.netlify.app. It was not redirected to another domain. Clear
- The earliest public archive of this site is from 2026-10-07. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.04 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-07 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 5 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-je0.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.