---
title: "Is portal-moonshot-oco.netlify.app a Scam? Trust Score 0/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "portal-moonshot-oco.netlify.app"
verdict: "Critical Risk"
title: "Is portal-moonshot-oco.netlify.app a Scam? Score 0/100"
trust_score: 0
classification_confidence: 47
canonical_url: https://trustsniffer.com/report/portal-moonshot-oco.netlify.app
assessed: 2026-10-21
---

# Is portal-moonshot-oco.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

## Verdict


**Verdict: Critical Risk, trust score 0/100.** portal-moonshot-oco.netlify.app shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-21 by automated analysis. Classification confidence 47%.

| Field | Value |
| --- | --- |
| What this site appears to be | The page is a Netlify 'Site not found' 404 error page, indicating the requested path or site does not exist on Netlify. It contains no service, product, or business content, and no forms, links, or tracking elements were captured. |

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 5 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 1% confidence (AbuseIPDB, 4 reports; shared hosting inflates reports) | Clear |
| Domain age | Not available (No registration record was returned) | Noted |
| Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted |
| Hosted by | AMAZON-02 (Server in US) | Noted |

## The page as captured


![Screenshot of the portal-moonshot-oco.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-oco.netlify.app/screenshots/first.png)

_What portal-moonshot-oco.netlify.app served when TrustSniffer captured it on 2026-10-21. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.

## Full analysis


### Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on a public static-hosting platform whose homepage returns the platform's generic "Site not found" 404 page. The page says the address does not exist and offers a "Start building" prompt for the hosting service. It presents no products, services, company information, contact details or monetization model. Its apparent purpose therefore cannot be determined from the visible content. The hostname, a "portal" style name with a "moonshot" label, suggests a deployment staged for a user-facing portal that is not currently resolving to published content.


### Scam/Impersonation Risk

Contradictory signals are present, and they come from external reputation rather than from the page text. Several independent security engines currently flag the domain as malicious, including one tier-one vendor, and this amounts to a confirmed **blacklist** listing. The detections do not say whether the concern is phishing, malware or something else, so the nature of the threat is unspecified. The visible 404 page carries no fraud language and no solicitation. The browser-behavior evidence conflicts with that quiet surface. Across all three sandbox runs, the page contained concealed forms, including password-type fields, even though the visible content is only an error notice. Interaction also triggered an unusually large burst of page restructuring, which means the displayed placeholder is not the whole of what the page can render. A hidden credential-capture surface behind an innocuous error page is a recognised pattern for staged phishing infrastructure. Separately, the hostname closely resembles the hosting platform's own brand, which raised a lookalike-naming signal. No confirmed impersonation or conflicting legal identities were observed. Four abuse reports were recorded against an address in the shared hosting provider's range. These reflect shared infrastructure and cannot be attributed to this site specifically, but they were not discounted in the assessment. Evidence:

- Homepage: the captured page is a hosting-provider 404 notice with no business content, forms, links or tracking elements visible.
- Homepage behavior: concealed forms with password-type fields were detected in 3 of 3 sandbox runs, and the page showed 4,130 DOM mutations after interaction.
- External reputation: 5 engines reported the domain as malicious, and the combined detections confirm a blacklist listing.
- Shared provider address: 4 abuse reports were logged against a shared-infrastructure address (confidence score 1), not attributable to this operator specifically.

### Regulatory Verification Notes

No legal, terms, privacy, about or contact pages were captured, so no licensing claim, registration number, company name or regulator reference can be assessed. Because the page is a platform placeholder, the missing disclosures say little about the intended operator's conduct. They also mean nothing on the site supports identity verification, and the real-world operator remains unverified. The ownership and governance picture is opaque, and no on-site disclosure offsets it. This is a verification gap, not evidence of wrongdoing on its own. The reputational concern rests on the external detections described above, not on this gap. No third-party broker or regulator listing matched this domain, so there is no independent regulatory context. Evidence:

- Whole site: no legal-entity name, license, registration number, terms or privacy page was captured, and the homepage reported 404 status.
- Transport encryption: the TLS certificate is organization-validated (OV), issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc., and valid to 2027-03-19. It authenticates the hosting platform and says nothing about the operator behind this subdomain.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).

### What to Verify Next

The first step is to establish who controls this subdomain and what it is meant to serve. The party that supplied the link, such as an email, message or advertisement, should be contacted through a separately known channel and asked to confirm that it published this address. Anyone who received a link containing this hostname should compare it against the official address of the organization it claims to represent, obtained independently. The official support or contact channels should be confirmed directly. If the link purports to lead to an account or payment portal, access should be via the organization's known primary domain only. Any organization that appears to be impersonated should be notified so it can request takedown through the hosting platform's abuse process. Evidence:

- Homepage: the page offers no operator, brand or contact information to check, so confirmation must come from outside the site.
- Hostname: the site is a subdomain of a public hosting service, so control over the address can change without the platform's reputation changing.
- Sandbox behavior: the concealed credential-type fields make it unsafe to test the site by submitting any information.

### Summary Verdict

The assessment is a clearly elevated-risk posture. Confirmed external threat detections combine with concealed credential-type form behavior beneath a blank placeholder page. No identity evidence offsets these, because none is verifiable. The result is a critical trust rating that the site's technical hygiene cannot lift.


### Infrastructure Integrity

The site is served from addresses in Amazon's network (AS16509) behind the hosting platform's cloud edge, and all four observed addresses are edge nodes. The origin server was not observable. The certificate is valid and issued by a mainstream authority. This is a mitigating factor only. It shows that the platform's infrastructure is sound and does not show that the content or operator is trustworthy. Edge-only visibility also means the content behind the hostname can change quickly without any change in the infrastructure.


### Closing Assessment

The site should not be used for sign-in, credential entry or any financial or personal-data interaction. Links to it should be treated as untrusted until the legitimate operator is independently confirmed. Any credentials already entered should be changed on the genuine service.


_Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content.

### 01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`)

### 02 Behaviour in a sandbox
- The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`)
- The page replaced a large part of its own content after loading. (Behaviour in a sandbox `rule:BEHAV_DOM_CHANGE_HIGH`)
- The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on. (Behaviour in a sandbox `rule:BEHAV_DOM_DIFF_AFTER_INTERACTION`)

### 03 Page content
- The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`)

### Signals weighed against the site

- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNVERIFIED |
| Identity score | 30/100 |
| Identity verification confidence | 50% |

- No on-site identity signals detected

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of portal-moonshot-oco.netlify.app.

- The request stayed on portal-moonshot-oco.netlify.app. It was not redirected to another domain. (Clear)
- It is hosted on AMAZON-02, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 5 flagged \| AbuseIPDB: 1% confidence, 4 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-oco.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [marketrankinghub-ux.netlify.app](https://trustsniffer.com/report/marketrankinghub-ux.netlify.app), a similar name (Critical Risk, 4/100)
- [pumpfunlivestreamers.netlify.app](https://trustsniffer.com/report/pumpfunlivestreamers.netlify.app), a similar name (Critical Risk, 23/100)
- [wrapfixsummary.netlify.app](https://trustsniffer.com/report/wrapfixsummary.netlify.app), a similar name (Critical Risk, 5/100)
- [donutclientss.netlify.app](https://trustsniffer.com/report/donutclientss.netlify.app), a similar name (Critical Risk, 0/100)
- [airdrop-is-live.netlify.app](https://trustsniffer.com/report/airdrop-is-live.netlify.app), a similar name (Critical Risk, 0/100)
- [token-giveaway-live.netlify.app](https://trustsniffer.com/report/token-giveaway-live.netlify.app), a similar name (Critical Risk, 0/100)
- [crypto-kqv.netlify.app](https://trustsniffer.com/report/crypto-kqv.netlify.app), a similar name (Critical Risk, 0/100)
- [crypto-1hz.netlify.app](https://trustsniffer.com/report/crypto-1hz.netlify.app), a similar name (Critical Risk, 0/100)
- [altatweer.ly](https://trustsniffer.com/report/altatweer.ly), another site assessed as critical-risk (Critical Risk, 0/100)
- [radiosouvenirs.be](https://trustsniffer.com/report/radiosouvenirs.be), another site assessed as critical-risk (Critical Risk, 0/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [Stablecoin Freezes, Oct 23, 2026: 8 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-23)
- [How to check if TRC20 USDT is genuine Tether](https://trustsniffer.com/blog/how-to-check-if-trc20-usdt-is-genuine-tether)
- [Stablecoin Freezes, Oct 27, 2026: 7 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-27)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-oco.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-oco.netlify.app · assessed 2026-10-21.*