Websites "start" at 7 points (cautiously safe), then they can get more points if they're older and have minimal or no tracking or JS, for example, since those are common attack vectors. Manually looking at Moonala.com it seems it has quite a bit of tracking and JS, so it didn't get any extra points.

If their IP or domain is found in any malicious/malware list, they instantly get 0 points, for example.