Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
portal-moonshot-vyh.netlify.app is low-trust and potentially risky.
| What this site appears to be | The page is Netlify's default 'Site not found' 404 response, which means the requested path or site is not deployed. It contains no product, login, form, or business content. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 4 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 1% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Noted |
| Hosted by | AMAZON-02Server in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Overview
This website is a hosted subdomain on a commercial site-building platform that returns the platform's stock "Site not found" error page. The page says the requested site or path is not deployed and offers a generic prompt to start building a site. It shows no products, pricing, login, branding or operator information, so no business model is visible. Its hostname is styled like an account or "portal" address.
Scam/Impersonation Risk: Contradictory signals are present and are serious. Several independent threat-intelligence sources currently flag the address as malicious or suspicious, and this amounts to a confirmed blacklist listing. No phishing page, impersonated login or conflicting legal identity was observed. Page analysis did flag the hostname as closely resembling the hosting platform's own brand, but nothing on the page confirms impersonation. The more concerning finding is behavioral. The visible page is a static error notice with no forms, yet the automated browsing sessions detected hidden forms in every run, including password-type fields. They also recorded an unusually large volume of page changes after interaction. Hidden credential-capable forms behind a blank page are a pattern associated with staged or swapped content, so the benign appearance of the page is not reassuring. The page also shows no clear purpose, which means a visitor cannot tell what the address is for or who operates it.
Regulatory Verification Notes: The site makes no licensing, registration or regulated-activity claims, and it has no terms, privacy, about or contact pages. As a result, no legal entity, jurisdiction or accountable operator can be associated with it, and its real-world identity remains unverified. That absence is a disclosure gap and not evidence of wrongdoing by itself. In this case, though, it combines with the confirmed reputation listing and the hidden-form behavior, so nothing on the site offsets those findings. No third-party broker or regulatory record matched the site. The valid, organization-validated certificate belongs to the hosting platform and says nothing about the operator of this subdomain.
What to Verify Next: The site should not be treated as a counterparty until an independent source ties it to a named operator. If a link to this address was received in an email, message or advertisement, the sender should be asked through a separately known channel what the address is meant to host, and the link should not be relied on until that is confirmed. Official contact channels should be confirmed through an offline or independently sourced route. Any organization that claims to operate this "portal" should be able to supply its legal name and a license or registration reference, which can then be checked against the relevant registry. The address should also be re-tested later, since the content may change once a real site is deployed.
Summary Verdict: The site carries an elevated-risk posture. Confirmed adverse reputation listings and hidden credential-capable form behavior outweigh the benign appearance of the error page. The operator cannot be identified, and the available evidence gives no basis for treating the address as legitimate.
Infrastructure Integrity: The site is delivered through Amazon-operated edge infrastructure, and all four observed addresses are edge nodes with no origin server visible. The valid certificate and mainstream cloud provider are mitigating factors, but they cannot offset the reputation findings. Edge-only visibility also makes it impossible to verify the real hosting independently, and it allows content to be changed quickly without any visible sign. Four abuse reports were logged against one of the shared edge addresses. Because that address serves many tenants, the reports are weak evidence about this site specifically.
Closing Assessment: Account credentials, passwords, personal data and payment details should not be entered on this address, and nothing should be downloaded from it. Any link that directs a person to it should be treated as untrusted until the sender and purpose are confirmed through an independent channel. Organizations should block or flag the address in email and web filtering while the adverse listings remain.
- Homepage: renders only the platform's default "Site not found" notice, with no business content, contact details or operator disclosure.
- Homepage behavior: hidden forms, including password-type inputs, were detected in all three sandbox runs although no form is visible.
- Homepage behavior: about 4,130 page mutations were recorded after interaction on a page of roughly 368 characters of text.
- Reputation checks: 4 malicious and 1 suspicious detections from threat-intelligence sources, with an external blacklist hit confirmed.
- Homepage: no company name, license number, registration details or legal pages are present.
- Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV), subject organization Netlify, Inc, valid to 2027-03-19.
- Hosting infrastructure: served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
- Homepage: the page names no operator, so the claimed owner of the address has to come from outside the site.
- Reputation checks: the listing is current, so any later change in status should be confirmed against fresh results.
- Page behavior: hidden password-type forms mean any future deployment on this address should be inspected before use.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox, page content.
01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
02 Behaviour in a sandbox
- The page contained a form a visitor cannot see.Behaviour in a sandbox
rule:BEHAV_HIDDEN_FORMS - The page replaced a large part of its own content after loading.Behaviour in a sandbox
rule:BEHAV_DOM_CHANGE_HIGH
03 Page content
- The page appears to present itself as a known brand it is not verified to belong to.Page content
rule:PAGE_BRAND_SUSPECTED - The page content shows at least one warning sign that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_SOME
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of portal-moonshot-vyh.netlify.app.
- The request stayed on portal-moonshot-vyh.netlify.app. It was not redirected to another domain. Clear
- It is hosted on AMAZON-02, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 4 flagged | AbuseIPDB: 1% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-vyh.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.