Is 22qq-client.com a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website presents itself as 22QQ Client, a free Minecraft PvP modification for Fabric 1.21.11, offering visitors a downloadable client, installation instructions, module information, and gameplay-oriented features intended to alter or extend in-game behavior.

Scam/Impersonation Risk

The site’s content is distribution-focused and does not present login forms, payment functionality, or obvious financial solicitation. However, that benign page presentation is outweighed by confirmed external threat signals: the domain is blacklisted, and multiple security detections classify it as malicious or suspicious. The downloadable client includes functions such as Auto Hit Crystal, Trigger Bot, HitBox, Target ESP, Auto Totem, and bypass-related modules, creating a software-execution risk even though the page itself does not display conventional phishing mechanics. No distinct conflicting legal identities or explicit brand impersonation were identified in the supplied page evidence. Evidence:

• The homepage offers a downloadable Minecraft client and installation flow involving Fabric Loader, Fabric API, and placement of a client JAR in the local mods directory.
• The homepage describes automation and evasion-oriented functions, including Auto Hit Crystal, Trigger Bot, HitBox, Target ESP, and bypass modules.
• External reputation telemetry records 16 malicious detections and 2 suspicious detections, with a confirmed blacklist result from two external sources.
• Browser analysis found no login form, hidden form, external password submission, wallet connection, or clipboard-hijacking behavior on the homepage.

Regulatory Verification Notes

The website’s apparent software-distribution purpose does not itself establish a regulated activity, and no financial service or regulated product is presented. Nevertheless, the reviewed content does not provide a clearly attributable legal operator, publisher identity, registration reference, or licensing information, leaving the real-world identity unverified. The domain is newly registered rather than long-established, which provides limited provenance support. A valid TLS certificate confirms encrypted transport but does not validate the publisher or the software. Evidence:

• The homepage identifies the product as “22QQ Client” but does not, in the reviewed content, identify a legal company or independently verifiable publisher.
• Domain registration telemetry records creation on 2026-03-14 and an age of 0.53 years, with Web Commerce Communications Limited dba WebNic.cc listed as registrar.
• The site is served through AS214351, associated with FEMOIT - FEMO IT SOLUTIONS LIMITED, GB.
• TLS telemetry records a DV certificate issued by YR1, valid through 2026-12-20.

What to Verify Next

Before any download or execution, the purported publisher should be established through an independent channel and the client should be validated using a trusted malware-analysis process and cryptographic integrity information obtained from a separately verified source. The requested Minecraft and Fabric versions should also be confirmed against authoritative project documentation, and any support or update channel should be independently authenticated rather than trusted solely because it is linked from the site. Evidence:

• The homepage provides an executable client-download workflow but supplies no independently verified publisher identity.
• The homepage specifies Minecraft 1.21.11, Fabric Loader, Fabric API, and a client JAR installation process, creating a concrete software-supply-chain verification requirement.
• The reviewed page contains no external links or social-presence references that independently corroborate the publisher.

Summary Verdict

The overall posture is critical risk for sensitive interaction. The site may have a coherent software-download presentation, but the confirmed blacklist status and malicious detections create a materially adverse trust conclusion, while the operator identity remains unverified.

Infrastructure Integrity

Cloudflare CDN/WAF protection is present and provides a mitigating layer against direct exposure, but it does not establish legitimacy. The observed address was an edge address associated with AS214351, and the origin was not observable in this analysis; consequently, infrastructure protection cannot offset the adverse external reputation evidence.

Closing Assessment

Interaction should be limited to passive review; downloading, executing, authenticating through, or providing sensitive information to the site should be withheld unless the publisher and software have been independently validated.