---
title: "Is portal-moonshot-jk0.netlify.app a Scam? Trust Score 0/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "portal-moonshot-jk0.netlify.app"
verdict: "Critical Risk"
title: "Is portal-moonshot-jk0.netlify.app a Scam? Score 0/100"
trust_score: 0
classification_confidence: 75
canonical_url: https://trustsniffer.com/report/portal-moonshot-jk0.netlify.app
assessed: 2026-10-20
---

# Is portal-moonshot-jk0.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

## Verdict


**Verdict: Critical Risk, trust score 0/100.** portal-moonshot-jk0.netlify.app shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-20 by automated analysis. Classification confidence 75%.

| Field | Value |
| --- | --- |
| What this site appears to be | Hosting-provider 404 page reading 'Site not found' with no published content, services, forms, or claims to assess. |

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 5 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 0% confidence (AbuseIPDB, 2 reports; shared hosting inflates reports) | Clear |
| Domain age | 15 days old (Most scam domains are under a year old) | Risk |
| Web archive | Archived since 2026 (1 snapshot) | Clear |
| Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted |

## The page as captured


![Screenshot of the portal-moonshot-jk0.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-jk0.netlify.app/screenshots/first.png)

_What portal-moonshot-jk0.netlify.app served when TrustSniffer captured it on 2026-10-20. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2026.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a newly observed subdomain on a shared site-hosting platform. Its root page shows only the platform's generic "Site not found" 404 notice, with an invitation to "Start building". It has no products, services, forms, legal pages, contact details or other published content. The hostname's "portal" and "moonshot" wording suggests a login or access gateway, so the address is likely meant to be reached through a link sent by a third party. No business model is visible.


### Scam/Impersonation Risk

Hard contradictory signals are present. The hostname is **blacklisted** by external threat intelligence: several security engines, including a leading endpoint-security vendor, classify it as malicious or suspicious. The detections apply to the site's own hostname, not just to its shared infrastructure. The page also triggers a suspected-brand flag because the hostname closely resembles the hosting platform's own name. That is a lookalike indicator only. No explicit impersonation of a named brand, no phishing page and no conflicting legal identities were observed. The visible content is a generic error page. The behavioural evidence is what stands out. Hidden forms were detected in every sandbox run, and password-type form elements were present even though nothing visible is rendered. The page also generated more than 4,000 DOM mutations after interaction, far more than a static 404 should produce. It made dozens of external requests, including about twenty outbound POSTs and a number of XHR calls, but none went to non-whitelisted destinations. The domain resolves with a very low TTL and fast-flux-like characteristics. A dormant placeholder carrying concealed credential-capture markup, dynamic DOM behaviour and external blacklist hits is consistent with staged or cloaked phishing infrastructure waiting to be activated, or with a compromised or abandoned deployment. Cloaking was not detected during testing, so this remains an inference from the combination of signals and not a confirmed phishing finding. Evidence:

- Behavioural testing (three of three runs, homepage): hidden forms and password-type form elements were present on a page with no visible forms.
- Homepage: about 4,130 DOM mutations after interaction, plus 34 external network requests (14 XHR/fetch, 20 POSTs) on a 404 page.
- Domain provenance: first observed 2026-10-07 (about 13 days old, ~0.04 years), with a single archive snapshot and 1 year tracked.
- Threat-intelligence aggregation: 5 malicious and 1 suspicious detections, with one top-tier vendor flagging the hostname.

### Regulatory Verification Notes

The site makes no regulatory, licensing or registration claims and publishes no legal, terms, privacy, about or contact pages. No operator name, company, jurisdiction or support channel appears anywhere on the site, so independent identity verification is not possible. The content gap is total, and it leaves nothing to corroborate the apparent purpose of the address. No third-party broker or regulatory-registry match was found, so no external reputational or licensing signal exists either way. The transport encryption does not help identify the operator. The certificate is organisation-validated, but it is issued to the hosting platform and not to the site's operator. It shows that the platform's shared edge is encrypted. It says nothing about who controls this subdomain. Evidence:

- Homepage: the page offers no company name, licence number, jurisdiction, policy pages or contact information.
- Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
- Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19.

### What to Verify Next

Anyone who received this address by email, message or advertisement should treat the sender's claim as unverified. They should confirm the sender and the intended destination through an independent, previously trusted route, such as a known official website typed in directly or a call to a number from an official source. Any legitimate organisation should be able to supply its canonical domain. Users should not enter credentials, payment details or wallet information here. Passwords entered into this address should be considered exposed and changed. If the link arrived unsolicited or claimed to be from a service the recipient uses, it should be reported to that service and to the hosting platform's abuse channel. Security teams may monitor the hostname for content changes, because the placeholder could be replaced at any time. Evidence:

- Homepage: the root path returns a 404 "Site not found" notice that includes a platform-internal reference ID, which can be quoted when reporting to the hosting platform.
- Page type: the capture shows no navigation, links or social presence, so no on-site route exists for confirming the operator's identity.

### Summary Verdict

Available evidence supports a clearly high-risk posture. External threat intelligence and anomalous behavioural indicators converge on a site that has no verifiable operator and no published content to offset them. The deterministic assessment is the lowest trust tier, and the site should be regarded as unsafe for any sensitive interaction.


### Infrastructure Integrity

The site is served from addresses in Amazon's cloud network, behind the hosting platform's CDN/WAF layer. All four observed addresses are edge servers, and the origin is not observable. This is a mitigating factor only and does not establish legitimacy, because the same shared edge serves many unrelated sites. Two abuse reports on one of the edge addresses are attributed to the shared provider infrastructure and are discounted. They are not counted against this specific site. Edge-only visibility also means content can be swapped quickly without any change in apparent hosting.


### Closing Assessment

Interaction beyond passive viewing should be avoided. No login, credential entry, payment or wallet connection should occur at this address, and nothing should be downloaded from it. Any request that directed a person here should be handled as potentially hostile and escalated to the relevant security or fraud team.


_Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, page content, history in the web archive.

### 01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`)

### 02 Behaviour in a sandbox
- The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`)

### 03 Hosting and network
- The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`)

### 04 Page content
- The page shows few of the signs expected from a trustworthy operator. (Page content `rule:PAGE_TRUST_QUALITY_LOW`)

### 05 History in the web archive
- The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`)

### Signals weighed against the site

- AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNVERIFIED |
| Identity score | 30/100 |
| Identity verification confidence | 50% |

- No on-site identity signals detected

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of portal-moonshot-jk0.netlify.app.

- The request stayed on portal-moonshot-jk0.netlify.app. It was not redirected to another domain. (Clear)
- The earliest public archive of this site is from 2026-10-07. (Clear)
- It is hosted on AMAZON-02, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::259 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | 0.04 years (continuous registration) |
| Domain expiry | Not available |
| Archive first seen | 2026-10-07 |
| Archive snapshots | 1 |
| Reputation | VirusTotal: 5 flagged \| AbuseIPDB: 0% confidence, 2 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-jk0.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [transfarusdttbep20.netlify.app](https://trustsniffer.com/report/transfarusdttbep20.netlify.app), a similar name (Critical Risk, 5/100)
- [darkcarderdrainer.netlify.app](https://trustsniffer.com/report/darkcarderdrainer.netlify.app), a similar name (Critical Risk, 5/100)
- [usdttransferhub.netlify.app](https://trustsniffer.com/report/usdttransferhub.netlify.app), a similar name (Critical Risk, 5/100)
- [etherconfig.netlify.app](https://trustsniffer.com/report/etherconfig.netlify.app), a similar name (Critical Risk, 0/100)
- [liveallocationpage-ux.netlify.app](https://trustsniffer.com/report/liveallocationpage-ux.netlify.app), a similar name (Critical Risk, 0/100)
- [azxzzzzzzzz.netlify.app](https://trustsniffer.com/report/azxzzzzzzzz.netlify.app), a similar name (Critical Risk, 5/100)
- [marketrankinghub-ux.netlify.app](https://trustsniffer.com/report/marketrankinghub-ux.netlify.app), a similar name (Critical Risk, 4/100)
- [pumpfunlivestreamers.netlify.app](https://trustsniffer.com/report/pumpfunlivestreamers.netlify.app), a similar name (Critical Risk, 23/100)
- [health-secure.online](https://trustsniffer.com/report/health-secure.online), another site assessed as critical-risk (Critical Risk, 0/100)
- [puep.fun](https://trustsniffer.com/report/puep.fun), another site assessed as critical-risk (Critical Risk, 0/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen)
- [Trading Platform Scam: Checking a Blocked Balance](https://trustsniffer.com/blog/trading-platform-scam-checking-a-blocked-balance)
- [Connect a Wallet to a Scam Site: What Happens](https://trustsniffer.com/blog/connect-wallet-to-a-scam-site-what-happens)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-jk0.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-jk0.netlify.app · assessed 2026-10-20.*