Is snublab.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a newly established promotional page for a token-distribution campaign. Its homepage is titled "Snub Network Allocation Is Live | Claim Your SNUB" and invites visitors to claim an allocation of a token called SNUB. The apparent purpose is to draw visitors into a claim-your-tokens flow, a pattern commonly used to solicit wallet interaction, personal details or payments.

Scam/Impersonation Risk

Multiple independent reputation sources converge on this domain. A major browser safe-browsing service classifies it as a social-engineering threat. A substantial number of security engines, including several top-tier vendors, flag it as malicious, and the combined detections constitute a confirmed blacklist listing. No conflicting legal identities or brand impersonation were observed. The risk therefore rests on the external threat listings, not on identity inconsistency. The homepage's urgent "allocation is live / claim your SNUB" framing is a classic engagement lure, since a free-claim offer pressures visitors to act before checking who runs the campaign. Behavioural testing showed no wallet-connection prompts, clipboard tampering, hidden forms or cloaking. It did show that most of the page's background requests go to third-party destinations, and several data submissions are sent to non-whitelisted external endpoints. Data entered on the page could therefore leave the site's own domain. The site is also only a few months old, so there is no operating record to offset the threat listings. Evidence:

• Homepage: titled as a live token-allocation claim, an unverified free-claim offer with no identifiable operator in the captured content.
• Reputation checks: the safe-browsing service returned a social-engineering match, and 14 security engines flagged the domain as malicious (2 more as suspicious), including three tier-1 vendors.
• Homepage behaviour: 3 outbound data submissions to non-whitelisted external destinations, about 71% of background requests external, and 3 console errors across 3 test runs.
• Domain provenance: registered 2026-08-06 (~0.22 years, about 82 days old); the web archive holds 1 snapshot, in 2026 (1 year tracked).

Regulatory Verification Notes

The captured pages show no licence, registration number or corporate entity that would tie the campaign to a regulated operator. The domain registration is incomplete as to owner details, which amounts to ownership opacity. That is an administrative limitation and not an identity contradiction. The site's identity could not be independently connected to any real-world brand or person, so no legitimacy can be inferred from its claims. No third-party broker or regulatory-database entry was matched. For a token distribution that invites users to claim assets, the absence of any disclosed issuer, terms or compliance framework is material context, though not by itself evidence of wrongdoing. Evidence:

• Legal and identity content: no operator name, licence or registration details were identified in the captured homepage.
• Registrar: the domain is registered through NICENIC International Group Co., Limited, with expiry set for 2027-08-06.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: the TLS certificate is DV-level, issued by WE1 and valid to 2027-01-02, which confirms only encrypted transport and no operator identity.

What to Verify Next

Any claim to the SNUB token should be checked through channels entirely independent of this site, such as the token's official project documentation reached via a trusted, previously known source, not via links on this page. Whether a legitimate SNUB project exists, and whether this domain is formally linked from its verified channels, should be confirmed before any interaction. Any operator or contact details should be validated offline or through an independent registry. Organisations should check whether the domain appears in their own mail, messaging or web-proxy logs, since campaigns like this are often distributed through unsolicited links. Evidence:

• Homepage: the claim offer provides no verifiable project, issuer or documentation reference within the captured content.
• Reputation listings: the active threat listings should be rechecked before any change in posture is considered.
• Registration record: the short operating history gives no baseline against which claims of an established project can be tested.

Summary Verdict

The assessment is a clearly high-risk, critical-trust posture. Confirmed external threat listings decisively outweigh the site's technically orderly setup, and the site's unverified identity and very recent origin give no basis for reassurance. The domain should be treated as a probable social-engineering vehicle until independent evidence shows otherwise.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address, so the origin server is not visible. This mitigates some exposure to direct attack, but it also prevents independent verification of where the content is actually hosted. It does not confirm legitimacy and cannot offset the active threat listings. Content on a CDN-fronted site can also be changed quickly without any visible infrastructure change.

Closing Assessment

Read-only observation of the site, from an isolated environment where possible, is the only proportionate use. Visitors should not log in, enter credentials or personal data, connect a wallet, approve transactions, or make any payment or transfer through this site. Users who have already interacted with it should treat any shared credentials or wallet approvals as potentially exposed. They should rotate or revoke them and report the domain to their security team or the relevant abuse channels.