--- title: "Is osbot.net Safe? Risk Report, Score 40/100" source: TrustSniffer type: Website trust & fraud report subject: "osbot.net" verdict: "Low Trust" title: "Is osbot.net Safe? Warning Signs, Score 40/100" trust_score: 40 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/osbot.net assessed: 2026-10-09 --- # Is osbot.net safe? TrustSniffer's low-trust assessment: 40/100 ## Verdict **Verdict: Low Trust, trust score 40/100.** osbot.net is low-trust and potentially risky. Several risk patterns were present. Do not send money or personal details until you have verified this business another way. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-09 by automated analysis. Classification confidence 75%. | Field | Value | | --- | --- | | What this site appears to be | OSBot is a downloadable automation client for Old School RuneScape offering free scripts and premium tools. The page focuses on product features: performance, security, stability, cross-platform downloads, and a developer API. | ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 3 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear | | Domain age | 3 months old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2002 (348 snapshots) | Clear | | Certificate | Encrypted connection (Issued by YE2) | Noted | ## The page as captured ![Screenshot of the osbot.net homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/osbot.net/screenshots/first.png) _What osbot.net served when TrustSniffer captured it on 2026-10-09. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2002. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Security Alert Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution. OSBot is a software-download website presenting an automation client for Old School RuneScape, with free scripts, premium tools, cross-platform downloads, and a developer API. Its apparent business model is freemium software monetization through premium subscriptions or paid upgrades for users seeking broader automation capability. ### Scam/Impersonation Risk The site presents a clear software product and does not show an apparent brand-impersonation pattern, conflicting legal identities, or a phishing form in the supplied page evidence. However, the website is subject to a confirmed blacklist finding and multiple external malicious or suspicious detections, including a high-confidence threat signal from an external security provider. This is a material contradiction to the otherwise coherent product presentation and is the principal reason the site should be treated as unsuitable for sensitive interaction. The available evidence does not establish whether the detections relate to the operator, the downloadable software, or compromised infrastructure, so attribution remains limited; the operational risk remains significant regardless. Evidence: - External reputation assessment recorded multiple malicious detections and one suspicious detection, with a Tier-1 threat signal present. - The site was recorded on external blacklist sources. - The homepage describes OSBot as an automation client for Old School RuneScape and offers a download pathway, but the supplied behavioral evidence found no hidden forms, password-external forms, wallet activity, or cloaking. ### Regulatory Verification Notes The homepage footer identifies “Meire & Brito Automation BV,” but the available evidence does not independently verify that entity’s relationship to the domain or software. The site is a gaming-automation product rather than an evidently regulated financial service, and no licensing claim or license number is presented in the supplied content; this is a transparency point for identity and contractual due diligence, not by itself evidence of fraud. The product’s stated use for casual automation and “goldfarming” may also create account-enforcement or platform-terms exposure for users, although that is distinct from the confirmed external security findings. Historical records show substantial prior domain activity, while the current registration record is materially more recent; the historical record therefore provides provenance context but does not independently validate the present operator. Evidence: - The homepage footer names Meire & Brito Automation BV, while independent identity verification is recorded as unverified. - WHOIS records show registration on 2026-07-15, with an age of 0.24 years and expiry on 2027-07-15. - Historical records contain 348 snapshots spanning 2002–2026, covering 25 tracked years. ### What to Verify Next Before any download, installation, account sign-in, or payment, an enterprise or individual user should obtain the software through an independently validated channel and compare its publisher, hash, signing certificate, and requested permissions against the operator’s formally confirmed identity. The named company should be verified through an authoritative corporate registry and through an independently sourced contact route rather than relying solely on the website. Any use should also be assessed against Old School RuneScape’s applicable terms and the organization’s software-installation controls. Evidence: - The homepage offers Windows, macOS, and Linux downloads and states that Java is required. - The homepage includes a “Sign In” pathway but no visible login form was observed in the supplied capture. - Behavioral testing recorded three successful runs, with no wallet connection, clipboard hijacking, hidden forms, or password submissions detected. ### Summary Verdict The overall posture is **low trust with elevated sensitive-interaction risk**. The site’s coherent software presentation and historical web presence do not offset the confirmed blacklist status and multiple external malicious detections, while the operator’s identity remains unverified. Normal browsing may be possible, but the available evidence does not support treating downloads, credentials, or other sensitive interactions as trusted. ### Infrastructure Integrity The site is protected by Cloudflare CDN/WAF infrastructure, with observed Cloudflare edge addresses and additional potential origin candidates. The underlying hosting is associated with AS-HOSTINGER, Hostinger International Limited, in Ukraine; this infrastructure provides some exposure mitigation but is not evidence that the operator or downloadable software is legitimate. Evidence: - Hosting is identified as AS47583, AS-HOSTINGER — Hostinger International Limited, CY; observed server IP: 92.113.16.170, country UA. - Cloudflare edge addresses observed include 104.21.12.194, 172.67.153.55, 2606:4700:3031::ac43:9937, and 2606:4700:3034::6815:cc2. - Transport encryption uses a DV TLS certificate issued by YE2, valid to 2026-12-12. ### Closing Assessment The proportionate course is to avoid downloading or installing the client and to suspend credential or payment activity until the operator, software provenance, and external detections have been independently resolved. _Written analysis generated 2026-10-09 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 5 findings contributed to this verdict, raised by governance, external reputation, hosting and network, behaviour in a sandbox, registration and ownership. ### 01 Governance - What the site offers, as described on its own pages, limits how high the score can go until more of it can be verified. (Governance `rule:gov_business_model_cap`) ### 02 External reputation - Several malware engines flagged this domain. (External reputation `rule:EXT_BLACKLIST_HIGH`) ### 03 Hosting and network - The domain is young and has almost nothing else set up around it. (Hosting and network `rule:DNS_SPARSE_YOUNG_DOMAIN`) - Several separate hosting and network checks came back negative. (Hosting and network `rule:DNS_MULTIPLE_NEGATIVE_SIGNALS`) ### 04 Behaviour in a sandbox - The page sent data to a destination TrustSniffer does not recognise. (Behaviour in a sandbox `rule:BEHAV_NONWHITELISTED_POSTS`) ### 05 Registration and ownership - The public registration record for this domain is incomplete. (Registration and ownership `rule:KF_WHOIS_INCOMPLETE`) ## Identity verification | Field | Value | | --- | --- | | Status | UNVERIFIED | | Identity score | 30/100 | | Identity verification confidence | 50% | - No on-site identity signals detected _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of osbot.net. - The request stayed on osbot.net. It was not redirected to another domain. (Clear) - Registration is published under Ultahost, Inc.. (Clear) - DNS for this domain is served by dns-parking.com, across 2 name servers. (Noted) - The registration is paid up to 2027-07-15. (Noted) - The earliest public archive of this site is from 2002-07-26. (Clear) - It is hosted on AS-HOSTINGER, from a server in UA. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Ultahost, Inc. | | Hosting | AS-HOSTINGER - Hostinger International Limited, CY | | Country | UA | | Server IP | 2a02:4780:44:1691:79db:bae2:50c:5522 | | Name servers | APOLLO.DNS-PARKING.COM, ATHENA.DNS-PARKING.COM | | CDN / edge network | Detected (cloudflare) | | Resolved IP addresses | 8 | | Edge IP addresses | 4 | | Likely origin IP addresses | 4 | | SSL issuer | YE2 | | SSL expiry | 2026-12-12 | | Domain age | 0.24 years (continuous registration) | | Domain expiry | 2027-07-15 | | Archive first seen | 2002-07-26 | | Archive snapshots | 348 | | Reputation | VirusTotal: 3 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about osbot.net at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [selfclawai.net](https://trustsniffer.com/report/selfclawai.net), another .net site assessed as low-trust (Low Trust, 40/100) - [niggersmp.net](https://trustsniffer.com/report/niggersmp.net), another .net site assessed as low-trust (Low Trust, 29/100) - [trouserstreak.net](https://trustsniffer.com/report/trouserstreak.net), another .net site assessed as low-trust (Low Trust, 25/100) - [funnymap.net](https://trustsniffer.com/report/funnymap.net), another .net site assessed as low-trust (Low Trust, 40/100) - [numerologynumber.net](https://trustsniffer.com/report/numerologynumber.net), another .net site assessed as low-trust (Low Trust, 25/100) - [firesidelodge.net](https://trustsniffer.com/report/firesidelodge.net), another .net site assessed as low-trust (Low Trust, 25/100) - [acgfunds.net](https://trustsniffer.com/report/acgfunds.net), another .net site assessed as low-trust (Low Trust, 25/100) - [3med.net](https://trustsniffer.com/report/3med.net), another .net site assessed as low-trust (Low Trust, 40/100) - [portal-moonshot-v2f.netlify.app](https://trustsniffer.com/report/portal-moonshot-v2f.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [portal-moonshot-c4h.netlify.app](https://trustsniffer.com/report/portal-moonshot-c4h.netlify.app), another site assessed as low-trust (Low Trust, 25/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Fake Airdrop Sites Show a Number, Not a Transfer](https://trustsniffer.com/blog/fake-airdrop-sites-show-a-number-not-a-transfer) - [Crypto Scam Websites in 2026: What a List Misses](https://trustsniffer.com/blog/crypto-scam-websites-2026-what-a-list-misses) - [Stablecoin Freezes, Oct 23, 2026: 8 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-23) --- *Source: [TrustSniffer](https://trustsniffer.com/report/osbot.net) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/osbot.net · assessed 2026-10-09.*