What Gridinsoft observed on m[.]gaybloom[.]com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261103161514-b03d93d5
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Limited review
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The limited first-party assessment is inconclusive; it does not certify the complete service.
Analyst findings
Review 3 documented observations View evidence
The current apex and mobile HTML no longer contains the fixed 115/135 match strings or the corresponding loader elements described on October 22. Selected linked JavaScript still defines and instantiates YBTextLoader; a remaining class alone does not establish that those old fixed-match displays are active. Public entries show GayBloom registration, not another service’s credentials. No account, profile or transaction was tested.
- Public artifact URL hxxps://gaybloom[.]com/
- Public artifact URL hxxps://m[.]gaybloom[.]com/
- Public artifact URL hxxps://gaybloom[.]com/landing/resource/id/fafb946df3a83dbd1d9931f1c4830778.js
Rendered Terms and Billing Policy were identical between the two hosts. Terms sections9.1/9.2 require cancellation at least24 hours before renewal; Billing Policy says before the collection date and any time before the recurring payment date. The different cutoff descriptions remain unresolved. Both documents disclose automatic renewal and trial conversion to a monthly subscription. A wording inconsistency is not proof of an unauthorized charge.
- Public artifact URL hxxps://gaybloom[.]com/staticPage/terms
- Public artifact URL hxxps://m[.]gaybloom[.]com/staticPage/terms
- Public artifact URL hxxps://gaybloom[.]com/staticPage/billingpolicy
- Public artifact URL hxxps://m[.]gaybloom[.]com/staticPage/billingpolicy
The current apex URL evidence retains Kaspersky and Webroot; mobile evidence retains CyRadar, Kaspersky and Webroot. Direct Avira Scam and Norton Malicious remain for both hosts: four distinct providers for the apex and five for mobile. These separate assessments are not phishing or fraud reproduced in the inspected public flow.
- Analyst observation Security-provider assessments, 2026-11-03
Scope and limitations
- Private functionality, all server files, transaction outcomes and clearance by other warning providers were not independently audited or authenticated.
Help protect others by sharing this page on social media! The more people who know about m.gaybloom.com, the fewer chances they have to deceive someone else. Help others evaluate m.gaybloom.com by sharing this page on social media!