Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
nebula-client.com is low-trust and potentially risky.
| What this site appears to be | Informational site for Nebula Client, a Fabric mod for Hypixel SkyBlock. Provides module lists, installation instructions, compatibility details, licensing (MIT) and explicit warnings that many modules automate gameplay and may lead to Hypixel bans. The site is unofficial and does not host a separate launcher; the Fabric build is described as free. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | None flagged itVirusTotal | Clear |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 6 months oldMost scam domains are under a year old | Risk |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by YR1 | Noted |
The page as captured
Key findings
- Automated classification: Governance Risk.
- Domain age: less than 1 year (registration continuity).
- No flags from the reputation services TrustSniffer consulted at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This website is an informational project site for Nebula Client, a Fabric modification for Hypixel SkyBlock. It presents module documentation, installation guidance, compatibility information, and a free single-file Fabric build, with the apparent purpose of distributing and explaining an unofficial open-source gaming modification.
Scam/Impersonation Risk
The site’s own content is consistent with an informational software project and does not show a login form, payment workflow, brand-impersonation claim, or phishing interface. However, the domain has a confirmed blacklist hit, and external assessment identified one Fortinet threat detection together with two suspicious results, despite no malicious result from another evaluated source. This externally recorded reputation conflict is decisive for the risk posture: the site should be treated as potentially unsafe for downloading or executing software until the distribution chain and current content are independently validated. No conflicting legal-entity names or direct on-page impersonation indicators were observed.
- External reputation assessment records the domain as blacklisted; Fortinet is identified among the flagged vendors, with two suspicious results and no malicious result from the separate evaluated source.
- The site homepage describes Nebula Client as an unofficial Fabric mod and explicitly states that many modules automate gameplay and may result in a permanent Hypixel ban.
- Domain registration telemetry records creation on 2026-04-26, approximately 0.47 years ago, through Web Commerce Communications Limited dba WebNic.cc.
Regulatory Verification Notes
The observed business model is an informational and download-oriented software project rather than a financial or regulated service. The site identifies the software as MIT licensed and states that the Fabric build is free, but those statements establish a software licensing position, not regulatory authorization or an independently verified operating identity. The available pages do not establish a named real-world operator or regulated entity, so identity remains unverified and governance disclosure is unclear. This is a transparency limitation rather than a separate finding of impersonation.
- The homepage presents Nebula Client as a Fabric mod for Minecraft 1.21+ and labels the project MIT licensed.
- The homepage states that the distribution is a single `.jar` with no separate launcher and describes the Fabric build as free.
- The site’s transport certificate is DV-validated, issued by YR1, and valid until 2026-12-21T18:04:14+00:00.
- Hosting telemetry identifies AS214351 operated by FEMOIT - FEMO IT SOLUTIONS LIMITED, GB.
What to Verify Next
Before any execution of the downloaded software, an enterprise or individual should validate that the release version, project documentation, and distribution artifact remain consistent across the site and the project’s independently reachable source materials. The artifact should be scanned and tested in an isolated environment, with endpoint controls configured to prevent access to sensitive files, credentials, browser data, and unrelated game or system accounts. Any maintainer identity, release provenance, and software integrity claims should be confirmed through an independent channel rather than relying solely on the website.
- The download page identifies release 2.0.1 and the supported Fabric/Minecraft range as Fabric 1.21–26.2.
- The installation material describes a direct mod installation workflow rather than an account-based service.
- The site’s warning section expressly states that many modules automate gameplay and that use may breach Hypixel rules.
Summary Verdict
The overall posture is low trust with elevated exposure for software-distribution activity. Although the site presents coherent project documentation and no on-page credential or payment collection, the confirmed external blacklist status and unverified operator identity prevent a positive legitimacy conclusion.
Infrastructure Integrity
Cloudflare CDN and WAF protection are present, and the observed address was an edge endpoint rather than an independently exposed origin. This provides a useful layer of network protection but does not resolve the adverse reputation finding or establish the legitimacy of the site operator.
- The site is protected by Cloudflare CDN/WAF infrastructure.
- The observed edge address was 196.251.107.204; no origin candidate was identified in the infrastructure assessment.
Closing Assessment
The appropriate posture is to refrain from routine execution or account-sensitive use until the software provenance, current domain reputation, and maintainer identity have been independently validated. Any required testing should remain isolated and limited to non-sensitive environments.
Written analysis generated 2026-10-14 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by governance, external reputation, hosting and network, registration and ownership, page content.
01 Governance
- What the site offers, as described on its own pages, limits how high the score can go until more of it can be verified.Governance
rule:gov_business_model_cap
02 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
03 Hosting and network
- The domain was registered between three and six months ago.Hosting and network
rule:DNS_YOUNG_6M
04 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
05 Page content
- The page has no description for search engines, which established sites usually provide.Page content
rule:PAGE_SEO_MISSING_META - The page carries none of the structured previews for search and social sharing that established sites usually provide.Page content
rule:PAGE_SEO_NO_STRUCTURED
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of nebula-client.com.
- The request stayed on nebula-client.com. It was not redirected to another domain. Clear
- Registration is published under Web Commerce Communications Limited dba WebNic.cc. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-04-26. Noted
- It is hosted on FEMOIT, from a server in SC. Noted
Domain intelligence
| Registrar | Web Commerce Communications Limited dba WebNic.cc |
|---|---|
| Hosting | FEMOIT - FEMO IT SOLUTIONS LIMITED, GB |
| Country | SC |
| Server IP | 196.251.107.204 |
| Name servers | GANNON.NS.CLOUDFLARE.COM, KHLOE.NS.CLOUDFLARE.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 1 |
| Edge IP addresses | 1 |
| Likely origin IP addresses | 0 |
| SSL issuer | YR1 |
| SSL expiry | 2026-12-21 |
| Domain age | 0.47 years (continuous registration) |
| Domain expiry | 2027-04-26 |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 0 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about nebula-client.com at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.