--- title: "Is portal-moonshot-nea.netlify.app Safe? Risk Report, Score 25/100" source: TrustSniffer type: Website trust & fraud report subject: "portal-moonshot-nea.netlify.app" verdict: "Low Trust" title: "Is portal-moonshot-nea.netlify.app Safe? Score 25/100" trust_score: 25 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/portal-moonshot-nea.netlify.app assessed: 2026-10-20 --- # Is portal-moonshot-nea.netlify.app safe? TrustSniffer's low-trust assessment: 25/100 ## Verdict **Verdict: Low Trust, trust score 25/100.** portal-moonshot-nea.netlify.app is low-trust and potentially risky. Several risk patterns were present. Do not send money or personal details until you have verified this business another way. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-20 by automated analysis. Classification confidence 75%. | Field | Value | | --- | --- | | What this site appears to be | Netlify 'Site not found' 404 error page. It contains no site content, offers, forms, or claims, so no business or trust assessment is possible. | ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 4 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 1% confidence (AbuseIPDB, 4 reports; shared hosting inflates reports) | Clear | | Domain age | 15 days old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2026 (1 snapshot) | Clear | | Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted | ## The page as captured ![Screenshot of the portal-moonshot-nea.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-nea.netlify.app/screenshots/first.png) _What portal-moonshot-nea.netlify.app served when TrustSniffer captured it on 2026-10-20. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2026. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Security Alert Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution. This website is a single-page deployment on a free application-hosting platform, and the page it serves is the platform's default "Site not found" error. The page shows no products, offers, forms, pricing or business claims. Its apparent purpose cannot be determined from the content. The address is a portal-style subdomain that reads like a project or staging placeholder rather than an operating business. ### Scam/Impersonation Risk Contradictory signals are present, and they carry the weight of this assessment. Several security engines currently flag the address as malicious or suspicious, including at least one top-tier vendor, and the site is on a confirmed blacklist. That is a hard reputational contradiction that the harmless-looking error page does not offset. The sandbox also recorded concealed form elements in every run, including password-type fields, even though nothing visible is presented to a visitor. The page's structure also changed heavily after interaction. A page that is empty on the surface but loads concealed credential-capable forms and shifts its content is consistent with a staged or cloaked phishing kit. It also fits a deployment that was parked and later swapped for other content. The name also closely resembles the hosting platform's own brand, which raised a lookalike flag. This is a soft indicator and not a confirmed impersonation. No conflicting legal identities were found, because the site names no entity at all. Four abuse reports are attached to a shared network address used by the hosting platform. They apply to shared infrastructure and are not attributed to this site, so they add no independent weight against it. Overall, the evidence supports a clearly cautionary stance. The blacklist and the concealed credential-capable forms are what drive it. Evidence: - Homepage: only the platform's default 404 message is shown, with no business content, yet three of three sandbox runs detected concealed forms, including password fields. - Homepage behaviour: about 4,130 DOM mutations after interaction, which is far beyond what a static error page would produce. - Reputation: 4 malicious and 1 suspicious detections across the security engines consulted, including one top-tier vendor, plus a confirmed blacklist listing. - Domain provenance: the address was first observed on 2026-10-07 with a single archive snapshot (about 13 days of tracked history, registered 2026). ### Regulatory Verification Notes The site has no legal, terms, privacy, about or contact pages, and no licence or registration claim. Only the hosting platform's placeholder is visible, so there is no regulatory standing to assess. The operator is unidentified, and ownership and governance are opaque. This is a transparency gap and does not by itself indicate fraud. No third-party broker or regulator record matches this address, so no external reputational context applies. The valid, organisation-validated certificate is issued to the hosting platform, not to any operator of this site. It shows that the transport layer is sound and does not link the site to a real-world business. Evidence: - Entire site: no named company, licence, registration number or policy pages are published. - Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organisation Netlify, Inc, valid to 2027-03-19. - Broker and regulator lookup: no match found for this address. ### What to Verify Next The site should not be treated as an operating business until its operator is independently identified. The first step is to ask whoever supplied the link for the organisation's official, separately sourced website address. Any claimed company should then be checked against the relevant corporate and financial-services registers. Official support channels should be confirmed through an independent, offline route. If the link arrived by message or email, the sender should be asked to confirm it through another channel. Security teams should re-test the address later to see whether the content changes from the current placeholder. Evidence: - Homepage: no entity name or contact route is published to verify against. - Reputation records: the current blacklist and malicious detections should be rechecked after any content change. - Provenance: a very recent first appearance with a single archive capture gives no track record to rely on. ### Summary Verdict The site carries an elevated risk posture. Its content is an empty placeholder, but confirmed blacklisting, multiple malicious detections and concealed credential-capable forms outweigh the technically sound encryption. Its operator is unidentified. The available evidence does not support treating the site as trustworthy. ### Infrastructure Integrity The site is served from Amazon's network behind a content-delivery and web-protection layer, and all four observed addresses are edge servers. The real origin server could not be observed. The platform's protection and a well-formed certificate are mitigating factors only. They do not offset the reputation risk, and edge-only visibility prevents independent hosting verification and can mask rapid content swaps. The hosting is an established, mainstream platform and the infrastructure is stable, but a reputable host says nothing about the legitimacy of whoever deploys on it. Evidence: - Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US), registered with ARIN. - Edge exposure: four edge IPs observed, no origin candidates, and a low DNS time-to-live consistent with rapid rotation. ### Closing Assessment Interaction should be limited to passive viewing in an isolated environment. The site should not be used for logging in, entering credentials or making payments. Nothing should be downloaded from it, and it should be treated as unsafe for any sensitive action until its operator is independently identified and the current security listings are cleared. _Written analysis generated 2026-10-20 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 5 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, hosting and network, history in the web archive, page content. ### 01 External reputation - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`) ### 02 Behaviour in a sandbox - The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`) ### 03 Hosting and network - The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`) ### 04 History in the web archive - The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`) ### 05 Page content - The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`) ### Signals weighed against the site - AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website. ## Identity verification | Field | Value | | --- | --- | | Status | UNVERIFIED | | Identity score | 30/100 | | Identity verification confidence | 50% | - No on-site identity signals detected _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of portal-moonshot-nea.netlify.app. - The request stayed on portal-moonshot-nea.netlify.app. It was not redirected to another domain. (Clear) - The earliest public archive of this site is from 2026-10-07. (Clear) - It is hosted on AMAZON-02, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Not available | | Hosting | AMAZON-02 - Amazon.com, Inc., US | | Country | US | | Server IP | 2a05:d014:58f:6200::258 | | Name servers | Not available | | CDN / edge network | Detected (aws) | | Resolved IP addresses | 4 | | Edge IP addresses | 4 | | Likely origin IP addresses | 0 | | SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 | | SSL expiry | 2027-03-19 | | Domain age | 0.04 years (continuous registration) | | Domain expiry | Not available | | Archive first seen | 2026-10-07 | | Archive snapshots | 1 | | Reputation | VirusTotal: 4 flagged \| AbuseIPDB: 1% confidence, 4 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-nea.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [portal-moonshot-gcg.netlify.app](https://trustsniffer.com/report/portal-moonshot-gcg.netlify.app), a similar name (Low Trust, 25/100) - [robinhood-main-dex-wzp.netlify.app](https://trustsniffer.com/report/robinhood-main-dex-wzp.netlify.app), a similar name (Low Trust, 25/100) - [crypto-ota.netlify.app](https://trustsniffer.com/report/crypto-ota.netlify.app), a similar name (Low Trust, 25/100) - [portal-moonshot-vyh.netlify.app](https://trustsniffer.com/report/portal-moonshot-vyh.netlify.app), a similar name (Low Trust, 25/100) - [portal-moonshot-yri.netlify.app](https://trustsniffer.com/report/portal-moonshot-yri.netlify.app), a similar name (Low Trust, 25/100) - [crypto-npp.netlify.app](https://trustsniffer.com/report/crypto-npp.netlify.app), a similar name (Low Trust, 25/100) - [portal-moonshot-fxg.netlify.app](https://trustsniffer.com/report/portal-moonshot-fxg.netlify.app), a similar name (Low Trust, 25/100) - [portal-moonshot-uhv.netlify.app](https://trustsniffer.com/report/portal-moonshot-uhv.netlify.app), a similar name (Low Trust, 25/100) - [akirolabs.firebaseapp.com](https://trustsniffer.com/report/akirolabs.firebaseapp.com), another site assessed as low-trust (Low Trust, 38/100) - [zzzcoinonrbh.lol](https://trustsniffer.com/report/zzzcoinonrbh.lol), another site assessed as low-trust (Low Trust, 42/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Stablecoin Freezes, Oct 26, 2026: 11 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-26) - [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen) - [Trading Platform Scam: Checking a Blocked Balance](https://trustsniffer.com/blog/trading-platform-scam-checking-a-blocked-balance) --- *Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-nea.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-nea.netlify.app · assessed 2026-10-20.*