Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
donutclients.org is low-trust and potentially risky.
| What this site appears to be | A site hosting a curated library of Fabric 1.21.11 Minecraft client jars and addons for DonutSMP. Offers download links, installation steps, and safety/FAQ text. Emphasizes "undetected" status and account safety assurances. Primary risk is binary download safety and claims that may encourage rule-evading behavior. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 1 months oldMost scam domains are under a year old | Risk |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by WE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- No flags from the reputation services TrustSniffer consulted at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is a free-download library for Fabric-based Minecraft clients and addons tailored to DonutSMP players. It presents downloadable `.jar` files, installation guidance, and safety-oriented FAQ material, with an apparent community-distribution model focused on game performance, navigation, and utility features.
Scam/Impersonation Risk
No confirmed phishing, impersonation, conflicting legal identity, or blacklist contradiction was observed. However, the site’s homepage promotes executable Java archives, describes several clients as “STABLE & VERIFIED,” and claims “100% Undetection” and account-safety assurances without supplying equivalent evidence; this creates a material gap between high-stakes safety claims and demonstrated verification. The page also advertises functions associated with base finding, packet management, PvP mechanics, and “advanced navigation,” which may encourage rule-evading use and increases the consequence of installing an untrusted binary. External security screening recorded a threat detection, although other available checks did not classify the domain as malicious or blacklisted. The domain’s apparent legitimacy and real-world operator remain unverified.
- The homepage lists Krypton Client, Radium Client, 4E Client, Glazed Addon, Meteor Client, and Opsec with direct `.jar` download links.
- The homepage claims “100% Undetection,” displays “5K+ Downloads,” and labels the collection “STABLE & VERIFIED,” without presenting supporting validation details.
- Domain registration telemetry records creation on 2026-09-01 and an age of approximately 0.09 years.
- External screening recorded a security detection, while malicious-site and blacklist checks did not produce a confirmed malicious or blacklist result.
Regulatory Verification Notes
The available site materials identify a software-download service but do not independently establish a named legal operator, corporate affiliation, or accountable publisher. The About, Guide, and FAQ sections are present in the site navigation, yet the supplied content does not resolve the operator’s identity or provide an independently verifiable governance basis. No financial or regulatory license claim is relevant to the stated software-distribution model, but publisher accountability and software provenance remain transparency gaps. A separate broker-reputation dataset found no matching broker record; this is contextual only and does not validate the site or its downloads.
- The homepage identifies the service as “DonutSMP Clients — Fabric utilities for DonutSMP” and presents a download/client-library business model.
- The site navigation includes About, Guide, and FAQ pages, but the supplied page content does not establish a named legal entity or independently verified operator.
- Registration records list Ultahost, Inc. as registrar, with creation date 2026-09-01T01:38:36Z and expiration date 2027-09-01T01:38:36Z.
- Hosting telemetry records AS13335, CLOUDFLARENET - Cloudflare, Inc., US; the transport certificate is DV, issued by WE1, and valid until 2026-12-01T20:10:54+00:00.
What to Verify Next
Before proceeding, an organisation should independently identify the publisher through an offline or otherwise trusted channel and confirm that the stated client files are authorised for the relevant Minecraft server. Downloaded archives should be checked against independently published hashes or signatures, scanned using current endpoint controls, and tested only in an isolated environment without access to sensitive accounts. Server rules and any applicable software-distribution terms should also be confirmed before installation.
- The homepage supplies direct binary downloads but does not provide independent file-signing or hash-verification material in the supplied content.
- The site’s own safety assurances concern undetection and account safety, making independent validation of those claims necessary.
- The stated business model is free community distribution, with no identified accountable commercial publisher in the supplied materials.
Summary Verdict
The overall posture is low trust, with a sensitive-interaction risk that is not suitable for unverified installation or account-related use. The available evidence supports treating the site as an unverified software-distribution service rather than an established, independently authenticated publisher.
Infrastructure Integrity
The website is protected by Cloudflare CDN/WAF infrastructure, and observed addresses are CDN edge endpoints rather than a directly exposed origin. This reduces direct infrastructure exposure but is only a mitigating control; it does not establish the legitimacy or safety of the hosted files.
Closing Assessment
Prospective users should complete independent publisher, file-integrity, and isolated-environment checks before any installation or account interaction.
Written analysis generated 2026-10-05 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
3 findings contributed to this verdict, raised by external reputation, hosting and network, page content.
01 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
02 Hosting and network
- The domain was registered less than three months ago.Hosting and network
rule:DNS_NEW_DOMAIN_90D - The domain is young and has almost nothing else set up around it.Hosting and network
rule:DNS_SPARSE_YOUNG_DOMAIN
03 Page content
- The page content shows at least one warning sign that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_SOME - The page has no description for search engines, which established sites usually provide.Page content
rule:PAGE_SEO_MISSING_META - The page carries none of the structured previews for search and social sharing that established sites usually provide.Page content
rule:PAGE_SEO_NO_STRUCTURED
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of donutclients.org.
- The request stayed on donutclients.org. It was not redirected to another domain. Clear
- Registration is published under Ultahost, Inc.. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-09-01. Noted
- It is hosted on CLOUDFLARENET, from a server in US. Noted
Domain intelligence
| Registrar | Ultahost, Inc. |
|---|---|
| Hosting | CLOUDFLARENET - Cloudflare, Inc., US |
| Country | US |
| Server IP | 2606:4700:3032::ac43:c891 |
| Name servers | lamar.ns.cloudflare.com, rosalie.ns.cloudflare.com |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 4 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 0 |
| SSL issuer | WE1 |
| SSL expiry | 2026-12-01 |
| Domain age | 0.09 years (continuous registration) |
| Domain expiry | 2027-09-01 |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about donutclients.org at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.