Is layerbtc-net.web.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page promotional site titled "LayerBTC | Modular Bitcoin Layer 2 for Assets, Payments & Devs". It presents itself as a modular Bitcoin layer-2 platform aimed at asset issuers, payment users and developers. It operates as a subdomain on a shared application-hosting namespace, not on a dedicated registered domain, and its apparent purpose is to promote a crypto-themed network or ecosystem to prospective users and builders.

Scam/Impersonation Risk

This is a clearly cautionary case. Multiple independent threat-intelligence engines, including two tier-one security vendors, currently flag the site as malicious. That amounts to a confirmed blacklist condition, and it is the decisive contradiction in this assessment. A site that markets Bitcoin layer-2 "assets" and "payments" to the public is a natural lure for credential, wallet or payment capture. The external detections therefore weigh heavily against any sensitive interaction, and the site's own presentation does not offset them. The identity of the operator has not been independently established, so no real-world brand or party can be linked to the site. Four abuse reports were also logged against the shared content-delivery address the site resolves to. Those reports are attributed to shared provider infrastructure, so they are weak evidence against this specific site, and no discount reason applies. They are noted as a secondary reputational signal. Browser behavior testing found no external data submissions, wallet-connection attempts, clipboard manipulation, hidden forms or content cloaking. That reduces the likelihood of active drainer behavior during a passive visit, but it does not neutralize the external detections. No brand impersonation, conflicting legal identities or confirmed phishing page were observed in the page evidence. Evidence:

• Homepage: external reputation sources currently list the site as malicious, including detections from two tier-one security vendors, which triggers an automatic score ceiling.
• Domain provenance: registered 2026 (~0.15 years, about 53 days old), a very young domain with no established history.
• Web archive: 1 snapshot spanning 2026 only (1 year tracked), so there is no continuity of content or ownership to offer reassurance.
• Shared infrastructure: 4 abuse reports on the content-delivery address, most recently within the past two weeks, attributed to the shared provider rather than to this site specifically.

Regulatory Verification Notes

The site gives a visitor no independently confirmed legal operator, corporate registration or financial-services authorization. Its stated focus on assets and payments is a function that would normally be expected to sit within a regulated or clearly accountable framework. Ownership and governance opacity are both present. This is an accountability limitation, not an identity contradiction, because no conflicting legal entities were found. No third-party broker or regulatory-database match exists for this site, so there is no external licensing signal in either direction. The transport-layer posture is technically sound but says nothing about the operator. The certificate is valid and issued by a recognized authority, but it is a domain-validated type that confirms control of the hostname and not the identity of the organization behind it. Evidence:

• Homepage: the title and positioning describe a Bitcoin layer-2 for assets and payments, and the operator is not independently identified.
• Hosting: served from AS54113 (Fastly, Inc., US), a major commercial infrastructure provider, which carries no implication about the site's operator.
• Transport encryption: TLS certificate issued by WR4 (DV), valid to 2026-12-22.
• Third-party registry context: no broker-reputation record matched the site.

What to Verify Next

Anyone who encounters this site through a link, advertisement or message should confirm independently that the project exists. The check is to find its official domain through the project's established public channels, such as a verified social account or a known repository, and then compare it with this address. Any invitation to connect a wallet, sign a transaction, bridge or deposit assets, or enter credentials should be declined until that check is complete. Security teams should also add the address to monitoring, and review whether any traffic from users or systems has reached it. Evidence:

• Homepage: the address is a subdomain of a shared hosting namespace, which allows the same name to be recreated or imitated cheaply.
• Reputation: current external detections remain active, so re-checking the listing status after a period of time is meaningful.
• Behavior testing: no external submissions were observed in a passive visit, so the main exposure comes from taking actions on the site and not from loading it.

Summary Verdict

Available evidence supports an elevated-risk posture. Active external malicious detections are decisive. A very young domain with no meaningful history and no independently established operator reinforce that conclusion. The clean behavior observed during testing and the sound encryption setup are mitigating details only. They do not support treating the site as legitimate, and its safe use is limited to passive, read-only viewing.

Infrastructure Integrity

The site is delivered through Fastly's CDN and WAF, a reputable and widely trusted provider. Every observed address is a provider edge node, and the origin server was not observable. That limits independent verification of where the content is actually hosted and means content could be swapped quickly without any change in the visible address. The protection is a mitigating factor only. It cannot offset the reputational risk, and it should not be read as evidence that the site's content or operator is legitimate.

Closing Assessment

The site should not be used for login, credential entry, wallet connection, or any payment or asset transfer. Passive, read-only viewing from a hardened or isolated browser is the only appropriate interaction. Organizations should consider blocking the address and warning users who may have received links to it.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.