Is bob-the-builder.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website at bob-the-builder.xyz is a single-page promotional site titled "BOB THE BUILDER | $BOB on Solana". It presents itself as the landing page for a Solana-based token called $BOB, apparently as a crypto-asset promotion with a community and token-sale purpose. The captured homepage was reachable and carried a modest amount of text. The available evidence does not allow a more detailed description of the operator or any product mechanics.

Scam/Impersonation Risk

Contradictory signals are present, and they are decisive. The domain is on an external blacklist, and several major security vendors independently classify it as malicious or suspicious. This is a corroborated multi-source detection, not a single outlier. No brand impersonation or conflicting legal identities were observed. The risk therefore comes from the reputation signal, not from copied branding. The site also fits a high-risk profile: a very recently registered domain on an uncommon top-level domain, promoting a meme-style Solana token. That combination is a recurring pattern in token-promotion fraud and "rug pull" schemes, in which funds are collected and the site is abandoned. In the behavioral sandbox, the homepage generated a heavy volume of third-party requests. Many went to destinations outside the recognized, whitelisted set, including at least one outbound data submission to an unrecognized destination. The page also produced repeated script errors. The sandbox found no wallet-drainer behavior, clipboard manipulation, hidden forms, or content cloaking. These benign findings do not offset the blacklist and the detections. Evidence:

• Homepage: listed on an external blacklist and flagged by seven security engines as malicious and three as suspicious, including three tier-one vendors.
• Homepage: 36 external XHR/fetch calls (17 to non-whitelisted destinations) and 6 external POST requests (1 to a non-whitelisted destination) across three sandbox runs.
• Homepage: 10 console errors recorded; no wallet-connect, clipboard-write, or hidden-form activity observed.
• Domain registration: registered 2026-08-13 (~0.2 years, 74 days old), so the domain has essentially no operating history.

Regulatory Verification Notes

The site presents no verifiable legal entity, licensing statement, or corporate registration. Identity could not be independently connected to any real-world person or organization. Ownership details are incomplete, which amounts to ownership opacity, not an identity contradiction. A token-sale or investment-style offering would normally carry visible issuer and jurisdiction disclosures. No third-party broker or regulator listing was matched, and the absence of one is not evidence of misconduct. The regulatory gap is secondary to the reputation findings. Evidence:

• Homepage: no operator name, registered company, license, or jurisdiction identified.
• Domain registration: registered through Global Domain Group LLC, valid to 2027-08-13.
• Transport encryption: TLS certificate issued by WE1 (domain-validated only), valid to 2027-01-10. A certificate of this kind confirms domain control, not operator identity.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

No sensitive interaction should proceed. If the project's legitimacy still needs to be assessed, claims of an official token or team should be checked only through independent channels such as the issuer's verified social accounts or a reputable token tracker. Any claimed contract address should be compared with an independent blockchain explorer, not with the address shown on the site. Any regulatory or licensing claim should be confirmed directly with the named registry in the relevant jurisdiction. Official support and contact channels should be confirmed through a separate, trusted route. Evidence:

• Homepage: promotes a Solana token, so any contract address it shows can be checked on a public blockchain explorer.
• Domain registration: the domain is about 74 days old, so any claim of an established project or track record is unsupported by the domain's history.
• Homepage: the blacklist and the multi-vendor detections should be re-checked on the vendors' own reputation portals before the status is treated as cleared.

Summary Verdict

The available evidence supports an elevated-risk, clearly cautionary assessment. The site is brand new, its operator is unidentified, and it is under active, corroborated third-party threat detection. Technically sound basics do not change that conclusion. The site should be treated as untrusted until its reputation status is resolved and an accountable operator is demonstrably identified.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address. The origin server was not observable. This is a mitigating factor only. It shows commodity, mainstream hosting, but it cannot offset the external threat detections. Edge-only visibility also prevents independent verification of where the content is actually hosted, and it can mask rapid content changes.

Closing Assessment

The site should not be used for login, wallet connection, credential entry, or any financial transaction, and viewing should be limited to passive reading in an isolated environment. Anyone who has already interacted with it should treat any connected wallet or credentials as potentially exposed, revoke token approvals, and move assets if a wallet was linked.