Is bubblemaps.live a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents itself as an onchain intelligence platform. Its homepage is titled "The Onchain Intelligence Layer" and carries the Bubblemaps name. The captured page is a short text-based landing page. Its content does not clearly establish a business model or a verifiable operator, so its purpose cannot be confirmed from the evidence.

Scam/Impersonation Risk

This is the dominant concern. A broad set of independent security engines currently flags the domain as malicious, and several of the most widely deployed security vendors are among them. Those detections are corroborated by a confirmed blacklist listing and by a phishing-known marker in the domain's reputation history. The site reuses an established-sounding brand name in its page title on a recently registered domain with an uncommon top-level domain. That combination is a recognised pattern for brand-lookalike and credential-harvesting infrastructure. No conflicting legal entities were found, and no direct brand-impersonation finding was recorded. The risk rests on the reputation evidence, not on identity inconsistencies. Behavioural testing found no wallet-drainer routines, clipboard manipulation, hidden forms, or credential posts to external destinations. Cloaking was not observed either. However, the homepage generated heavy third-party network traffic, including a POST to a destination outside the recognised service set, and a high volume of script errors. These are consistent with unstable or hastily assembled front-end code. They do not offset the threat-intelligence detections, and a clean behavioural run on a single page does not exclude later content swaps. Evidence:

• Homepage: 15 security engines flagged the domain as malicious and 2 as suspicious, including three tier-one vendors.
• Domain registration: registered 2026-08-06 (~0.22 years, about 81 days old). Archive captures begin in January 2025, before the current registration date.
• Web archive: 4 snapshots spanning 2025–2026 (2 years tracked), a thin and sparse history.
• Homepage behavioural runs: 64 external XHR requests and 13 external POSTs, of which one POST and one XHR went to a non-whitelisted destination. 30 console errors were recorded, with no wallet-drainer, clipboard, or hidden-form activity.

Regulatory Verification Notes

The captured homepage text does not establish any named legal entity, licence, or registration that could be tested against a registry. The page-level analysis that would normally attribute identity could not be completed, so no operator is independently connected to the site. Registration details are incomplete and show ownership opacity. That is an administrative limitation and not an identity contradiction. No third-party broker or regulator-style reputation entry matched this domain. The adverse picture therefore comes from threat-intelligence signals, not from any regulatory finding. The site's valid encryption certificate and identified hosting network are baseline hygiene that phishing infrastructure routinely has. They are not evidence of legitimacy. Evidence:

• Homepage: no named operator, licence, or registration number is visible in the captured content.
• Hosting network: AS13335 (CLOUDFLARENET - Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV, domain-validated only), valid to 2027-01-02.
• Domain registration: registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, with registration running to 2027-08-06 and owner details incomplete.

What to Verify Next

Before any engagement, confirm through the brand's independently known official channels, reached by a route other than this site, whether this domain is an endorsed property. Anyone who has already visited or interacted with the site should treat any credentials or approvals submitted there as potentially exposed and review them accordingly. The reputation status should be re-checked only after the domain's owner publishes a clear remediation or ownership statement. Evidence:

• Homepage: the page title uses the Bubblemaps name, but nothing on the captured page ties the domain to that brand's official presence.
• Reputation record: the blacklist listing and engine detections are current and unresolved at the time of analysis.

Summary Verdict

The domain carries an elevated-risk posture. Active adverse security detections and a corroborated blacklist listing outweigh every neutral or positive technical signal. Its identity is unconnected to any verified operator, and its age and archive history are shallow. Taken together, the evidence does not support treating the site as trustworthy.

Infrastructure Integrity

The site is served through Cloudflare's CDN and web application firewall. All four observed addresses are edge nodes, and the origin server is not observable. This protective layer is a mitigating factor only. It prevents independent verification of the hosting origin and can mask rapid content changes. It cannot offset the reputational risk recorded against the domain.

Closing Assessment

At most, the site should be treated as read-only content. No login, credential entry, wallet connection, or financial interaction should take place on it. The brand should be reached only through destinations confirmed independently as official.