Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
osbot.net is low-trust and potentially risky.
| What this site appears to be | OSBot is a downloadable automation client for Old School RuneScape offering free scripts and premium tools. The page focuses on product features: performance, security, stability, cross-platform downloads, and a developer API. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 3 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0% confidenceAbuseIPDB, 0 reports; shared hosting inflates reports | Clear |
| Domain age | 3 months oldMost scam domains are under a year old | Risk |
| Web archive | Archived since 2002348 snapshots | Clear |
| Certificate | Encrypted connectionIssued by YE2 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- Public web-archive history exists since 2002.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
OSBot is a software-download website presenting an automation client for Old School RuneScape, with free scripts, premium tools, cross-platform downloads, and a developer API. Its apparent business model is freemium software monetization through premium subscriptions or paid upgrades for users seeking broader automation capability.
Scam/Impersonation Risk
The site presents a clear software product and does not show an apparent brand-impersonation pattern, conflicting legal identities, or a phishing form in the supplied page evidence. However, the website is subject to a confirmed blacklist finding and multiple external malicious or suspicious detections, including a high-confidence threat signal from an external security provider. This is a material contradiction to the otherwise coherent product presentation and is the principal reason the site should be treated as unsuitable for sensitive interaction. The available evidence does not establish whether the detections relate to the operator, the downloadable software, or compromised infrastructure, so attribution remains limited; the operational risk remains significant regardless.
- External reputation assessment recorded multiple malicious detections and one suspicious detection, with a Tier-1 threat signal present.
- The site was recorded on external blacklist sources.
- The homepage describes OSBot as an automation client for Old School RuneScape and offers a download pathway, but the supplied behavioral evidence found no hidden forms, password-external forms, wallet activity, or cloaking.
Regulatory Verification Notes
The homepage footer identifies “Meire & Brito Automation BV,” but the available evidence does not independently verify that entity’s relationship to the domain or software. The site is a gaming-automation product rather than an evidently regulated financial service, and no licensing claim or license number is presented in the supplied content; this is a transparency point for identity and contractual due diligence, not by itself evidence of fraud. The product’s stated use for casual automation and “goldfarming” may also create account-enforcement or platform-terms exposure for users, although that is distinct from the confirmed external security findings. Historical records show substantial prior domain activity, while the current registration record is materially more recent; the historical record therefore provides provenance context but does not independently validate the present operator.
- The homepage footer names Meire & Brito Automation BV, while independent identity verification is recorded as unverified.
- WHOIS records show registration on 2026-07-15, with an age of 0.24 years and expiry on 2027-07-15.
- Historical records contain 348 snapshots spanning 2002–2026, covering 25 tracked years.
What to Verify Next
Before any download, installation, account sign-in, or payment, an enterprise or individual user should obtain the software through an independently validated channel and compare its publisher, hash, signing certificate, and requested permissions against the operator’s formally confirmed identity. The named company should be verified through an authoritative corporate registry and through an independently sourced contact route rather than relying solely on the website. Any use should also be assessed against Old School RuneScape’s applicable terms and the organization’s software-installation controls.
- The homepage offers Windows, macOS, and Linux downloads and states that Java is required.
- The homepage includes a “Sign In” pathway but no visible login form was observed in the supplied capture.
- Behavioral testing recorded three successful runs, with no wallet connection, clipboard hijacking, hidden forms, or password submissions detected.
Summary Verdict
The overall posture is low trust with elevated sensitive-interaction risk. The site’s coherent software presentation and historical web presence do not offset the confirmed blacklist status and multiple external malicious detections, while the operator’s identity remains unverified. Normal browsing may be possible, but the available evidence does not support treating downloads, credentials, or other sensitive interactions as trusted.
Infrastructure Integrity
The site is protected by Cloudflare CDN/WAF infrastructure, with observed Cloudflare edge addresses and additional potential origin candidates. The underlying hosting is associated with AS-HOSTINGER, Hostinger International Limited, in Ukraine; this infrastructure provides some exposure mitigation but is not evidence that the operator or downloadable software is legitimate.
- Hosting is identified as AS47583, AS-HOSTINGER — Hostinger International Limited, CY; observed server IP: 92.113.16.170, country UA.
- Cloudflare edge addresses observed include 104.21.12.194, 172.67.153.55, 2606:4700:3031::ac43:9937, and 2606:4700:3034::6815:cc2.
- Transport encryption uses a DV TLS certificate issued by YE2, valid to 2026-12-12.
Closing Assessment
The proportionate course is to avoid downloading or installing the client and to suspend credential or payment activity until the operator, software provenance, and external detections have been independently resolved.
Written analysis generated 2026-10-09 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
5 findings contributed to this verdict, raised by governance, external reputation, hosting and network, behaviour in a sandbox, registration and ownership.
01 Governance
- What the site offers, as described on its own pages, limits how high the score can go until more of it can be verified.Governance
rule:gov_business_model_cap
02 External reputation
- Several malware engines flagged this domain.External reputation
rule:EXT_BLACKLIST_HIGH
03 Hosting and network
- The domain is young and has almost nothing else set up around it.Hosting and network
rule:DNS_SPARSE_YOUNG_DOMAIN - Several separate hosting and network checks came back negative.Hosting and network
rule:DNS_MULTIPLE_NEGATIVE_SIGNALS
04 Behaviour in a sandbox
- The page sent data to a destination TrustSniffer does not recognise.Behaviour in a sandbox
rule:BEHAV_NONWHITELISTED_POSTS
05 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of osbot.net.
- The request stayed on osbot.net. It was not redirected to another domain. Clear
- Registration is published under Ultahost, Inc.. Clear
- DNS for this domain is served by dns-parking.com, across 2 name servers. Noted
- The registration is paid up to 2027-07-15. Noted
- The earliest public archive of this site is from 2002-07-26. Clear
- It is hosted on AS-HOSTINGER, from a server in UA. Noted
Domain intelligence
| Registrar | Ultahost, Inc. |
|---|---|
| Hosting | AS-HOSTINGER - Hostinger International Limited, CY |
| Country | UA |
| Server IP | 2a02:4780:44:1691:79db:bae2:50c:5522 |
| Name servers | APOLLO.DNS-PARKING.COM, ATHENA.DNS-PARKING.COM |
| CDN / edge network | Detected (cloudflare) |
| Resolved IP addresses | 8 |
| Edge IP addresses | 4 |
| Likely origin IP addresses | 4 |
| SSL issuer | YE2 |
| SSL expiry | 2026-12-12 |
| Domain age | 0.24 years (continuous registration) |
| Domain expiry | 2027-07-15 |
| Archive first seen | 2002-07-26 |
| Archive snapshots | 348 |
| Reputation | VirusTotal: 3 flagged | AbuseIPDB: 0% confidence, 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about osbot.net at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.