Verdict
skyblock-extras.org shows high-risk / scam indicators.
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
| What this site appears to be | A download and information page for SkyBlock Extras (SBE), a free Hypixel SkyBlock client-side mod. Describes 100+ features, provides install steps, downloads for Fabric versions, and FAQ. States it's free and not affiliated with Hypixel or Mojang. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 7 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 1 months oldMost scam domains are under a year old | Risk |
| Web archive | Never archivedNo public history of this site | Watch |
| Certificate | Encrypted connectionIssued by YE1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: less than 1 year (registration continuity).
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Security Alert
Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
SkyBlock Extras is a software-download and information website presenting a free client-side Minecraft modification for Hypixel SkyBlock, with installation guidance, Fabric downloads, feature descriptions, compatibility information, and an FAQ. Its stated purpose is to distribute the SkyBlock Extras mod, which it describes as offering more than 100 features without requiring payment or user accounts.
Scam/Impersonation Risk
The site presents a low-risk-looking software-download experience: the homepage describes dungeon tools, pet tracking, GUI themes, quality-of-life functions, puzzle solvers, installation steps, and free downloads, while stating that it is not affiliated with Hypixel or Mojang. The page analysis found no login form, sensitive form, payment request, wallet interaction, suspicious script activity, or page-level red flags. However, these benign presentation signals are materially outweighed by confirmed external threat detections and a blacklist hit reported by multiple sources, including seven malicious detections and tier-one detections associated with Fortinet and Sophos. The available evidence therefore supports a high-risk assessment for downloading or executing software despite the absence of payment or credential collection. No identity contradiction, brand impersonation, or confirmed phishing classification was recorded in the structured findings, but the external reputation conflict remains decisive.
- Homepage: Describes SkyBlock Extras as a free Hypixel SkyBlock client-side mod with more than 100 features and states that it is not affiliated with Hypixel or Mojang.
- Homepage and download area: Provides Fabric downloads, installation instructions, compatibility information, and an FAQ; no payment or account requirement is presented.
- Technical reputation evidence: Records 7 malicious detections, 0 suspicious detections, and confirmed blacklist status, with Fortinet and Sophos identified among the flagged vendors.
- Domain registration: Registered 2026-08-07; approximately 0.12 years old.
Regulatory Verification Notes
This is presented as a software-distribution site rather than a financial, investment, or regulated-services provider, so the reviewed content does not establish a licensing requirement. The site does not provide an independently verified operator identity, corporate registration detail, or licensing number in the supplied content, and the available identity-verification status remains unverified. The stated non-affiliation with Hypixel and Mojang is a useful boundary disclosure, but it does not establish who operates or publishes the software. The registrar is identified as Web Commerce Communications Limited dba WebNic.cc; this is an administrative registration fact, not proof of legitimacy. The external broker-intelligence source contained no match, which neither clears the site nor offsets the confirmed security-reputation warnings.
- Homepage and FAQ: Identify the service as a free game-mod distribution site and provide no licensing or regulated-entity claim.
- Homepage: States that the project is not affiliated with Hypixel or Mojang, without independently identifying a verified legal operator.
- Registration record: Registrar listed as Web Commerce Communications Limited dba WebNic.cc; creation date 2026-08-07T17:20:12Z and expiration date 2027-08-07T17:20:12Z.
What to Verify Next
Before any download or execution, an enterprise security team should obtain the software through an independently confirmed publisher channel, compare the file’s cryptographic hash or publisher signature against a trusted release record, and detonate or scan the artifact in an isolated environment. The project’s official support and publisher channels should also be confirmed through an independent route, and the download should not be introduced into a production workstation until malware analysis is complete.
- Download area: Supplies executable mod downloads and installation instructions, making file provenance and integrity the primary verification objectives.
- Homepage and FAQ: Provide project information but do not, in the supplied content, provide an independently verified operator identity or external publisher-validation mechanism.
- Behavioral analysis: Recorded no external requests, hidden forms, wallet activity, clipboard activity, or suspicious inline scripts during two successful runs; this does not validate the downloaded software itself.
Summary Verdict
The website has a critical trust posture because confirmed blacklist and malicious-detection evidence conflicts with an otherwise benign informational presentation. Its operator identity is unverified, and the available evidence does not support treating the site as suitable for sensitive interaction or trusted software acquisition.
Infrastructure Integrity
The site is protected by Cloudflare CDN/WAF infrastructure, which provides a mitigating layer against direct exposure but does not establish legitimacy or neutralize the external threat findings. The observed address was an edge address, and the origin server was not observable in this analysis.
- Hosting infrastructure: Served through edge address 91.211.13.26 on AS203273, with the provider identified as NetCraftersOU - NetCrafters OU, EE.
- Transport security: TLS certificate issued by YE1 using DV validation, valid to 2026-12-16T17:47:09+00:00.
- CDN/WAF posture: Cloudflare detected; 1 edge IP observed and 0 likely origin candidates identified.
Closing Assessment
The proportionate business action is to suspend download and execution activity pending independent publisher, file-integrity, and sandbox validation; any exception should be formally approved by the responsible security team.
Written analysis generated 2026-09-18 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by registration and ownership, analysis engine, external reputation.
01 Governance Risk
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
02 Sensitive Interaction Risk
- The analysis matched a pattern TrustSniffer treats as a direct threat to a visitor.Analysis engine
signal:direct_threat - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of skyblock-extras.org.
- The request stayed on skyblock-extras.org. It was not redirected to another domain. Clear
- Registration is published under Web Commerce Communications Limited dba WebNic.cc. Clear
- DNS for this domain is served by cloudflare.com, across 2 name servers. Noted
- The registration is paid up to 2027-08-07. Noted
- It is hosted on NetCraftersOU, from a server in UA. Noted
Domain intelligence
| Registrar | Web Commerce Communications Limited dba WebNic.cc |
|---|---|
| Hosting | NetCraftersOU - NetCrafters OU, EE |
| Country | UA |
| Server IP | 91.211.13.26 |
| Name servers | andy.ns.cloudflare.com, brenna.ns.cloudflare.com |
| SSL issuer | YE1 |
| SSL expiry | 2026-12-16 |
| Domain age | 0.12 years (continuous registration) |
| Domain expiry | 2027-08-07 |
| Archive first seen | Not available |
| Archive snapshots | 0 |
| Reputation | VirusTotal: 7 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about skyblock-extras.org at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.