Is bullvers.cc a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at bullvers.cc is a newly registered site whose captured homepage carries only a short block of text and a page title that reads "FASTPANEL". It suggests a control-panel or dashboard-style landing page, but it names no product, service, operator, or business model. Its apparent purpose cannot be established from the observable content.

Scam/Impersonation Risk

Contradictory signals are present and are serious. The domain is blacklisted by external reputation sources, and several major security vendors independently flag it as malicious or suspicious. That is a convergent finding across feeds, not a single outlier. No conflicting legal identities and no brand impersonation were observed, but the blacklisting alone places the site in an elevated-risk category. The domain is also very recently registered. A site this young with an adverse reputation fits the profile of short-lived, throwaway infrastructure. The browser-behaviour analysis found no wallet-drainer activity, clipboard manipulation, hidden forms, cloaking, or externally posting credential forms, and the site's transport encryption is valid. These are neutral observations. They do not offset the external detections, because a minimal page can carry no visible payload while still being listed as malicious. The homepage did generate heavy outbound network traffic, including many background requests and form-style submissions to external hosts, and a few of those destinations are outside the commonly recognised set. Together with the sparse content, this pattern is consistent with a page that functions mainly as a relay or redirector rather than a self-contained service. Evidence:

• Homepage and external reputation: the domain is on third-party blacklists, and multiple major security vendors flag it as malicious or suspicious.
• Domain registration: registered 2026-09-02 (~0.14 years, about 50 days old), through NameSilo, LLC.
• Web-archive history: 2 archive snapshots spanning 2026-09-17 to 2026-09-22 (1 year tracked), showing a very thin public record.
• Homepage behaviour: 36 external fetch/XHR requests and 24 external POSTs across 3 sandbox runs, with 3 requests to non-whitelisted hosts.

Regulatory Verification Notes

The captured homepage discloses no operator name, company registration, licence, or legal or terms pages, so its on-page disclosure position is unclear. The real-world operator has not been independently connected to any person or organisation. Any claim of legitimacy would therefore be unsupported. No third-party broker or regulatory-database record matched this domain, so there is no external licensing signal in either direction. Registration privacy is applied through the registrar's privacy service. This is an administrative detail and not an identity contradiction. Positive technical signals exist, but they are baseline hygiene. A valid certificate and an identifiable hosting network are available to any newly created site, malicious ones included, and do not demonstrate legitimacy. Evidence:

• Homepage: about 400 characters of text, with no company name, address, licence number, or policy pages in the captured content.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (domain-validated only), valid to 2026-12-01, so no organisational identity is attested.
• Registration record: owner details are masked behind a privacy service, consistent with a standard registrar privacy offering.

What to Verify Next

Before any engagement, confirm through an independent route who actually operates the site and whether any organisation claims it. This means checking the official channels of any brand the site purports to belong to, not the contact details on the site itself. If the site was reached through a link, message, or advertisement, trace that referral back to its sender and confirm the sender's authenticity. Anyone who needs to assess the site further should do so only in an isolated, non-credentialed environment, and should recheck the external reputation status later to see whether the detections persist or are cleared. If the domain is expected to belong to a known service, ask that service directly whether it uses this address. Evidence:

• Homepage: the page title suggests a hosting or administration panel, but nothing on the page names a provider that could be asked to confirm it.
• Reputation: current adverse listings are the deciding factor, so a clean recheck is the only change that would justify revisiting the assessment.
• Provenance: the very short public history gives no earlier legitimate use of the domain to rely on.

Summary Verdict

The overall posture is critical. Adverse reputation evidence that several independent sources agree on, combined with a very new domain and almost no verifiable history or identity, outweighs the modest technical hygiene the site shows. No evidence of legitimate, established operation was found, so the site is treated as a confirmed elevated risk and not as an unknown entity.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and web application firewall, and every observed address is a Cloudflare edge address. The origin server was not observable. This is a mitigating factor only: it reduces direct exposure of the backend, but it also means the real hosting cannot be independently checked, and content can be changed quickly behind the edge. The infrastructure's protective features cannot offset the reputation findings. An unconfirmed heuristic notes sparse subdomain structure for a young domain, which adds no independent weight.

Closing Assessment

The site should be limited to, at most, passive viewing from a protected environment. Do not use it to log in, enter credentials or personal data, make payments, connect wallets, or download files. If it was received through an unsolicited message or advertisement, treat that message as suspect and report it to the relevant platform or security team.