---
title: "Is portal-moonshot-xi2.netlify.app a Scam? Trust Score 0/100"
source: TrustSniffer
type: Website trust & fraud report
subject: "portal-moonshot-xi2.netlify.app"
verdict: "Critical Risk"
title: "Is portal-moonshot-xi2.netlify.app a Scam? Score 0/100"
trust_score: 0
classification_confidence: 55
canonical_url: https://trustsniffer.com/report/portal-moonshot-xi2.netlify.app
assessed: 2026-10-22
---

# Is portal-moonshot-xi2.netlify.app a scam? TrustSniffer's high-risk assessment: 0/100

## Verdict


**Verdict: Critical Risk, trust score 0/100.** portal-moonshot-xi2.netlify.app shows high-risk / scam indicators.

This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.

Labels: Sensitive Interaction Risk, Governance Risk

Assessed 2026-10-22 by automated analysis. Classification confidence 55%.

## Evidence status and limitations


Evidence completeness: Not recorded

- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.

## At a glance

The checks that decide most of this verdict.

| Check | Result | Status |
| --- | --- | --- |
| Malware engines | 5 flagged it (VirusTotal) | Risk |
| Google Safe Browsing | Not listed (Google) | Clear |
| Abuse reports on the host | 1% confidence (AbuseIPDB, 4 reports; shared hosting inflates reports) | Clear |
| Domain age | Not available (No registration record was returned) | Noted |
| Certificate | Encrypted connection (Issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1) | Noted |
| Hosted by | AMAZON-02 (Server in US) | Noted |

## The page as captured


![Screenshot of the portal-moonshot-xi2.netlify.app homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/portal-moonshot-xi2.netlify.app/screenshots/first.png)

_What portal-moonshot-xi2.netlify.app served when TrustSniffer captured it on 2026-10-22. The page may look different now._

## Key findings


- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.

## Full analysis


### Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a Netlify-hosted subdomain with a generated "portal" style name. When captured, its homepage returned a "Site not found" error page with only a few hundred characters of text. It shows a visitor no product, brand, or service, so no business purpose can be established. Its behavior in a browser suggests it may be a staging or placeholder deployment, or a deployment that has been taken down or repurposed.


### Scam/Impersonation Risk

Contradictory signals are present and weigh heavily. The domain is **blacklisted**: several security engines report it as malicious, including a recognized top-tier endpoint-security vendor, and an external blacklist also lists it. Behavioral testing adds to the concern. Across all three automated visits, the homepage contained concealed form elements and password-entry fields even though it displays only an error message. The page also mutated heavily after interaction, and nearly all of its observed network activity went to external destinations. This is the pattern seen in credential-capture kits that sit behind a neutral facade. The domain name also closely resembles the hosting platform's own namespace, which is consistent with a lookalike. No conflicting legal identities appeared, but none could be established either, so identity contradiction is not the basis of this finding. The listings and the hidden-form behavior are enough to treat the site as high risk for any sensitive interaction. Evidence:

- Homepage: returned a "Site not found" error page with minimal text, yet hidden forms were detected in all three test runs and password fields were present.
- Homepage behavior: about 4,130 DOM mutations after interaction, with external traffic reaching roughly 99.6% of observed request share.
- Reputation: five engines rated the domain malicious and one suspicious, and an independent blacklist feed also lists it.

### Regulatory Verification Notes

The captured homepage names no company, operator, license, registration number, or jurisdiction, and it offers no terms, privacy, or contact pages. Because it is an error page, this is a content gap, not a disclosure by the operator. No regulator, broker-reputation database, or third-party registry matched the site, and none could corroborate its identity. The site cannot be tied to any real-world person or brand. Its legitimacy therefore cannot be inferred from its presentation. Its valid certificate and recognizable hosting prove only that the deployment is technically well-formed, not that its operator is trustworthy. Evidence:

- Homepage: no legal entity, address, license, or regulatory reference is displayed.
- Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
- Transport encryption: TLS certificate issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 (OV validation) to Netlify, Inc, valid to 2027-03-19. The certificate belongs to the hosting platform, not to the site's operator.

### What to Verify Next

Any organization that claims to operate this address should be asked to identify itself through a channel it controls, such as its corporate website or a published phone number, and not through this domain. Anyone who received a link to this address by message or email should confirm with the purported sender, by an independent route, that they sent it. Security teams should check proxy and mail logs for earlier visits to this address and reset credentials entered there. If a login page is claimed to exist, its URL should be confirmed only from an official source, not from the link received. Evidence:

- Homepage: the visible content gives no operator or brand to validate against, so confirmation must come from the party that supplied the link.
- Hidden form fields and password inputs on the captured page mean any submission could be sent to unknown external recipients.
- No terms, privacy, or support pages were observed from which to confirm an official channel.

### Summary Verdict

The assessment is critical. Confirmed third-party threat detections, together with concealed credential-style forms on a page that otherwise shows nothing, outweigh every technical hygiene factor. No independent identity for the operator is established. The site is not suitable for any interaction involving credentials, personal data, or money.


### Infrastructure Integrity

The site is served from Amazon Web Services address space behind a CDN/WAF layer. All four observed addresses are edge nodes, and the origin server could not be seen. This is protective infrastructure with a valid certificate, and it reduces only the technical exposure of the deployment. It does not offset the reputation findings. The edge-only view means hosting cannot be independently verified, and content could be swapped quickly. Four abuse reports exist against one of the shared provider addresses. They apply to shared infrastructure, so they are not necessarily specific to this site, but they were not discounted.


### Closing Assessment

At most, the address may be opened for read-only inspection from an isolated, non-production environment. No credentials, personal data, or payment details should be entered, and nothing should be downloaded from it. Anyone who has already interacted with it should change affected passwords and monitor the related accounts. Reporting the address to the hosting platform's abuse channel is appropriate.


_Written analysis generated 2026-10-22 by the TrustSniffer Analysis Engine from the evidence in this report._

## What the analysis found

2 findings contributed to this verdict, raised by external reputation, behaviour in a sandbox.

### 01 External reputation
- An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it. (External reputation `rule:EXT_BLACKLIST_CRITICAL`)

### 02 Behaviour in a sandbox
- The page contained a form a visitor cannot see. (Behaviour in a sandbox `rule:BEHAV_HIDDEN_FORMS`)
- Most of what the page loaded came from other domains rather than from this one. (Behaviour in a sandbox `rule:BEHAV_EXTERNAL_RATIO_HIGH`)
- The page replaced a large part of its own content after loading. (Behaviour in a sandbox `rule:BEHAV_DOM_CHANGE_HIGH`)
- The page rewrote itself after it was interacted with, so what a visitor first sees is not what they end up on. (Behaviour in a sandbox `rule:BEHAV_DOM_DIFF_AFTER_INTERACTION`)

### Signals weighed against the site

- AbuseIPDB: 4 reports on hosting IP 2a05:d014:58f:6200::258 (Amazon Data Services Ireland Ltd, Content Delivery Network), 1% confidence. The reports are attributed to shared infrastructure, not specifically to this website.

## Identity verification


| Field | Value |
| --- | --- |
| Status | UNKNOWN |
| Identity score | 50/100 |
| Identity verification confidence | 30% |

- AI page analysis unavailable (page captured; identity not AI-verified)

_Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._

## What TrustSniffer observed

First-party facts recorded during the assessment of portal-moonshot-xi2.netlify.app.

- The request stayed on portal-moonshot-xi2.netlify.app. It was not redirected to another domain. (Clear)
- It is hosted on AMAZON-02, from a server in US. (Noted)

## Domain intelligence


| Field | Value |
| --- | --- |
| Registrar | Not available |
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | US |
| Server IP | 2a05:d014:58f:6200::258 |
| Name servers | Not available |
| CDN / edge network | Detected (aws) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
| SSL expiry | 2027-03-19 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 5 flagged \| AbuseIPDB: 1% confidence, 4 reports \| Google Safe Browsing: 0 matches |

## About this assessment


**Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com)

A trust score summarises the evidence TrustSniffer could collect about portal-moonshot-xi2.netlify.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.

TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.

## Related on TrustSniffer
- [portal-moonshot-t6c.netlify.app](https://trustsniffer.com/report/portal-moonshot-t6c.netlify.app), a similar name (Critical Risk, 0/100)
- [portal-moonshot-hqj.netlify.app](https://trustsniffer.com/report/portal-moonshot-hqj.netlify.app), a similar name (Critical Risk, 0/100)
- [portal-moonshot-2zp.netlify.app](https://trustsniffer.com/report/portal-moonshot-2zp.netlify.app), a similar name (Critical Risk, 0/100)
- [portal-moonshot-man.netlify.app](https://trustsniffer.com/report/portal-moonshot-man.netlify.app), a similar name (Critical Risk, 0/100)
- [portal-moonshot-ifl.netlify.app](https://trustsniffer.com/report/portal-moonshot-ifl.netlify.app), a similar name (Critical Risk, 0/100)
- [get-memecoins.netlify.app](https://trustsniffer.com/report/get-memecoins.netlify.app), a similar name (Critical Risk, 0/100)
- [portal-moonshot-11c.netlify.app](https://trustsniffer.com/report/portal-moonshot-11c.netlify.app), a similar name (Critical Risk, 0/100)
- [portal-moonshot-oco.netlify.app](https://trustsniffer.com/report/portal-moonshot-oco.netlify.app), a similar name (Critical Risk, 0/100)
- [portal-moonshot-tn0.netlify.app](https://trustsniffer.com/report/portal-moonshot-tn0.netlify.app), a similar name (Critical Risk, 0/100)
- [thoreum-capital.pages.dev](https://trustsniffer.com/report/thoreum-capital.pages.dev), another site assessed as critical-risk (Critical Risk, 0/100)
- [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory
- [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band
- [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment
- [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening
- [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares

## Guides
- [How to revoke token approval after a scam site](https://trustsniffer.com/blog/how-to-revoke-token-approval-after-a-scam-site)
- [Stablecoin Freezes, Oct 26, 2026: 11 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-26)
- [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen)

---
*Source: [TrustSniffer](https://trustsniffer.com/report/portal-moonshot-xi2.netlify.app) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/portal-moonshot-xi2.netlify.app · assessed 2026-10-22.*