--- title: "Is portal-moonshot-pw8.netlify.app a Scam? Trust Score 0/100" source: TrustSniffer type: Website trust & fraud report subject: "portal-moonshot-pw8.netlify.app" verdict: "Critical Risk" title: "Is portal-moonshot-pw8.netlify.app a Scam? Score 0/100" trust_score: 0 classification_confidence: 55 canonical_url: https://trustsniffer.com/report/portal-moonshot-pw8.netlify.app assessed: 2026-10-19 --- # Is portal-moonshot-pw8.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100 ## Verdict **Verdict: Critical Risk, trust score 0/100.** portal-moonshot-pw8.netlify.app shows high-risk / scam indicators. This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-19 by automated analysis. Classification confidence 55%. | Field | Value | | --- | --- | | What this site appears to be | The requested path returns a Netlify 'Site not found' 404 page. The intended site content is unavailable, and the page contains no product, service, pricing, contact, or business information. | ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 5 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 1% confidence (AbuseIPDB, 4 reports; shared hosting inflates reports) | Clear | | Domain age | Not available (No registration record was returned) | Noted | | Web archive | Never archived (No public history of this site) | Watch | | Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted | ## The page as captured ![Screenshot of the portal-moonshot-pw8.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-pw8.netlify.app/screenshots/first.png) _What portal-moonshot-pw8.netlify.app served when TrustSniffer captured it on 2026-10-19. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. - The operator behind the site could not be independently connected to a real-world brand or person. ## Full analysis ### Security Alert Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution. This website is a subdomain on Netlify's shared hosting platform, and the only content it serves is Netlify's default "Site not found" 404 page. The page tells the visitor that a broken link was followed or that a URL does not exist, and it includes a platform reference ID and a prompt to "build and deploy your own site for free." It carries no products, pricing, contact details, business description or monetization model, so its purpose and operator cannot be determined from what it publishes. ### Scam/Impersonation Risk The assessment is **elevated and clearly cautionary**. The site is **blacklisted** by external threat-intelligence sources, and several independent security engines classify the hostname as malicious, including one tier-one security vendor. This reputation signal is decisive. The page content itself shows no scam mechanics, because it offers no products, yields or claims to evaluate. The evidence therefore rests on external detections and on the sandbox's behavioral observations. The sandbox found hidden forms, including password-type fields, in every run, although the visible page is a bare error screen. Document structure also changed heavily after interaction, which is not normal for a static 404 page. That pattern suggests content or form elements that are not shown to a casual visitor. It is consistent with a placeholder or staging pattern that could be swapped for a credential-collection page. The evidence does not prove this. A lookalike signal against the hosting platform's own name was also raised, but this is a platform subdomain and no brand impersonation or conflicting legal identities were confirmed. Separately, four abuse reports exist against one of the shared edge addresses serving the site. These are attributed to shared provider infrastructure and are not specific to this operator, so they reinforce the reputational picture without adding site-specific proof. Evidence: - Homepage: serves a default hosting-platform 404 with 368 characters of text, no title, no meta description and no visible forms. - Sandbox behavior: hidden forms detected in 3 of 3 runs, with 3 password-type forms and a maximum of 4,132 DOM mutations after interaction. - External reputation: 5 engines flagged the hostname malicious, including one tier-one vendor, alongside a confirmed external blacklist listing. - Shared edge address 2a05:d014:58f:6200::258: 4 abuse reports, attributed to shared provider infrastructure. ### Regulatory Verification Notes There are no legal, about, terms or licensing pages to assess, because the only content is the platform's error response. No operating entity, registration number, licensing authority or complaint channel is stated anywhere on the site. This is a content gap, not evidence of a scam on its own. The site's real-world operator is **not independently connected to any known person or brand**, so no legitimacy can be inferred from on-site identity claims. The valid organization-validated certificate names the hosting platform as its subject, not the site's operator, so it confirms the platform's identity only. No broker-reputation record matched the site, so no third-party regulatory or reputational context is available. The blacklisting described above is a reputational signal and not a licensing or legal verdict. Evidence: - Homepage: no company name, license, address or legal text is present. - Transport encryption: TLS certificate with OV validation, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, valid to 2027-03-19. - Hosting: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US). ### What to Verify Next Anyone who received this link should confirm through an independent, offline route (a known phone number or an official channel) which organization, if any, intended to publish it and what its correct address is. The intended destination should be reached only through a source the user has already trusted, not through this link. If the link arrived by email, message or advertisement, the sender's authenticity should be established before any further interaction, and the message should be reported to the relevant security team or platform abuse channel. An operator that claims to provide financial or account services should also be asked for its registry-verifiable corporate and licensing details. Any such details should be checked directly with the issuing registry. Evidence: - Homepage: contains no business information, so no operator can be identified from the site. - Sandbox behavior: hidden password-type forms were observed on a page with no visible content, which makes the origin of the link the key question. - Regulatory pages: no licensing or registration details exist on the site to check against a registry. ### Summary Verdict The site carries a critical, high-severity risk posture driven by confirmed external blacklisting and by hidden credential-style form behavior on an otherwise empty page. Identity is unverified and no legitimate purpose is evidenced. Technical hygiene and a valid certificate do not offset this assessment. ### Infrastructure Integrity The site is served entirely through Amazon-operated edge infrastructure behind Netlify's shared platform, and all observed addresses are edge servers. The true origin server was not observable. Because the platform hosts many unrelated sites on common addresses, this arrangement mitigates some exposure but cannot independently establish the legitimacy of this site. It also prevents independent verification of the hosting and allows content to be swapped quickly without any change in the visible address. Protective infrastructure is treated here as a mitigating factor only, and it does not outweigh the external threat detections. ### Closing Assessment The site should be treated as high-risk. Account logins, credential entry, payment details and any financial interaction should be avoided. Read-only viewing is the only use that fits the evidence, and any link that led here should be treated as untrusted until the sender has been independently confirmed. _Written analysis generated 2026-10-19 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content. ### 01 External reputation - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`) ### 02 Behaviour in a sandbox - The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`) - The page replaced a large part of its own content after loading. (Behaviour in a sandbox `rule:BEHAV_DOM_CHANGE_HIGH`) - The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on. (Behaviour in a sandbox `rule:BEHAV_DOM_DIFF_AFTER_INTERACTION`) ### 03 Page content - The page appears to present itself as a known brand it is not verified to belong to. (Page content `rule:PAGE_BRAND_SUSPECTED`) ### Signals weighed against the site - AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website. ## Identity verification | Field | Value | | --- | --- | | Status | UNVERIFIED | | Identity score | 30/100 | | Identity verification confidence | 50% | - No on-site identity signals detected _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of portal-moonshot-pw8.netlify.app. - The request stayed on portal-moonshot-pw8.netlify.app. It was not redirected to another domain. (Clear) - It is hosted on AMAZON-02, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Not available | | Hosting | AMAZON-02 - Amazon.com, Inc., US | | Country | US | | Server IP | 2a05:d014:58f:6200::258 | | Name servers | Not available | | CDN / edge network | Detected (aws) | | Resolved IP addresses | 4 | | Edge IP addresses | 4 | | Likely origin IP addresses | 0 | | SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 | | SSL expiry | 2027-03-19 | | Domain age | Not available (no registration date was returned) | | Domain expiry | Not available | | Archive first seen | Not available | | Archive snapshots | 0 | | Reputation | VirusTotal: 5 flagged \| AbuseIPDB: 1% confidence, 4 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-pw8.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [portal-moonshot-zpl.netlify.app](https://trustsniffer.com/report/portal-moonshot-zpl.netlify.app), a similar name (Critical Risk, 0/100) - [crypto-li7.netlify.app](https://trustsniffer.com/report/crypto-li7.netlify.app), a similar name (Critical Risk, 0/100) - [portal-moonshot-fog.netlify.app](https://trustsniffer.com/report/portal-moonshot-fog.netlify.app), a similar name (Critical Risk, 0/100) - [portal-moonshot-l7t.netlify.app](https://trustsniffer.com/report/portal-moonshot-l7t.netlify.app), a similar name (Critical Risk, 0/100) - [portal-moonshot-74u.netlify.app](https://trustsniffer.com/report/portal-moonshot-74u.netlify.app), a similar name (Critical Risk, 0/100) - [portal-moonshot-qlv.netlify.app](https://trustsniffer.com/report/portal-moonshot-qlv.netlify.app), a similar name (Critical Risk, 0/100) - [okxclaim-holdearntokenrewards.netlify.app](https://trustsniffer.com/report/okxclaim-holdearntokenrewards.netlify.app), a similar name (Critical Risk, 0/100) - [crypto-vdl.netlify.app](https://trustsniffer.com/report/crypto-vdl.netlify.app), a similar name (Critical Risk, 2/100) - [amministrazioni-torino.com](https://trustsniffer.com/report/amministrazioni-torino.com), another site assessed as critical-risk (Critical Risk, 5/100) - [metahuay.com](https://trustsniffer.com/report/metahuay.com), another site assessed as critical-risk (Critical Risk, 0/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Stablecoin Freezes, Oct 23, 2026: 8 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-23) - [How to check if TRC20 USDT is genuine Tether](https://trustsniffer.com/blog/how-to-check-if-trc20-usdt-is-genuine-tether) - [Stablecoin Freezes, Oct 27, 2026: 7 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-27) --- *Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-pw8.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-pw8.netlify.app · assessed 2026-10-19.*