Verdict
Several risk patterns were present. Do not send money or personal details until you have verified this business another way.
studio-oshilabs.web.app is low-trust and potentially risky.
| What this site appears to be | A landing page for the free mint of Studio PASS, an NFT tied to the Oshi Labs anime studio. Access is prioritized for Discord members and requires connecting a crypto wallet to submit the mint transaction. The page gives no verifiable legal identity, contract address, or audit information. |
|---|
Evidence status and limitations
Evidence completeness: Not recorded
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 1 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 3% confidenceAbuseIPDB, 4 reports; shared hosting inflates reports | Clear |
| Domain age | Not availableNo registration record was returned | Noted |
| Certificate | Encrypted connectionIssued by WR4 | Noted |
| Hosted by | FASTLYServer in US | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
- The operator behind the site could not be independently connected to a real-world brand or person.
Full analysis
Overview
Studio PASS Mint is a single-page NFT landing site for a project branded "Oshi Labs", an anime studio. It is hosted on a free web-app subdomain rather than a standalone branded domain. The page promotes a "FREE MINT" of Studio PASS tokens, with 777 spots reserved for Discord members and 2,222 in total. The remaining supply is open to the wider community until it sells out. Visitors are steered to join Discord, connect a crypto wallet, and submit a blockchain mint transaction. Navigation also points to "Tasks", "Rankings" and "My page" areas where "support" is recorded and "rewards" are promised. The apparent business model is community growth and engagement around a collectible, with revenue not stated.
Scam/Impersonation Risk
The site carries an elevated risk profile because a confirmed external threat-intelligence detection exists against it. A security engine flags the site as malicious and a second flags it as suspicious, so it is blacklisted by an outside source. No brand impersonation, phishing form, credential harvesting, hidden form, cloaking or wallet-drainer behaviour was observed. The page has no login or password form. Sandbox runs showed no clipboard hijacking, no fingerprinting and no suspicious inline scripts, and all outbound requests went to recognised destinations. The page's only request for sensitive action is the wallet connection needed to mint. That is the core exposure here: a visitor is asked to link a wallet and sign a transaction on a page that publishes no contract address, no audit reference and no identifiable operator. A malicious mint contract could drain assets, and nothing on the page lets a visitor rule that out. The "rewards" and "rankings" mechanics are vague and tied to open-ended "support" and "tasks", a common engagement pattern in token campaigns that can be used to funnel users toward later, unspecified wallet actions. The page's own labelling is also inconsistent: it describes the mint as open while a second reward tier is marked "coming soon". No identity contradiction exists, because no conflicting legal entities appear. Four abuse reports are attached to one of the shared network addresses serving the site. These apply to infrastructure shared with other tenants and are not specific to this project, so they are treated as background context rather than proof of misconduct. Evidence:
- Homepage: free mint of Studio PASS with 777 Discord-reserved and 2,222 total spots, requiring wallet connection and a mint transaction, with no stated price.
- Homepage: "Tasks", "Rankings" and "Rewards" language is undefined, with no terms explaining what "support" earns.
- Sandbox behaviour: 3 of 3 runs completed with no hidden forms, no cloaking and no drainer or clipboard activity, but with wallet connection requested.
- External reputation: 1 engine rated the site malicious and 1 suspicious; 4 abuse reports were logged against a shared edge IP, last reported within the past week.
Regulatory Verification Notes
The page discloses no legal entity, registered business address, company registration number, licence or regulatory status. It also publishes no terms of service, privacy policy or contract address, so there is no stated basis for the "Oshi Labs" claim beyond the page's own branding and links to Discord and X. The real-world operator therefore remains unverified, and the on-page identity claims cannot be treated as proof of who runs the project. This is a transparency gap and a verification matter in its own right. It is not, taken alone, evidence of wrongdoing. Nevertheless, in the context of the external detection above, it removes the accountability that would normally mitigate a wallet-interaction risk. No third-party broker or regulator listing was matched for this project. Evidence:
- Homepage: no legal name, address, registration number or licence reference.
- Homepage: no terms, privacy policy or contract address was found on the single captured page.
- TLS certificate issued by WR4 (DV, domain-validated only), valid to 2026-12-22. Encryption is in place, but DV validation confirms control of the domain, not the operator's identity.
- Served from AS54113 (Fastly, Inc., US).
What to Verify Next
Before any interaction, the project's identity should be confirmed through channels that do not depend on this page. The Oshi Labs name should be searched through an independent route to see whether an established studio, with an independently linked official site and social profile, endorses this mint address. The Discord invitation and the X profile should be checked for age, follower history and any official announcement of the mint. If a contract address is ever published, it should be checked on a public block explorer for source-code verification, deployer history and any approval or transfer functions that go beyond a simple free mint. Official support and contact routes should be confirmed offline or through the studio's already-known channels. Evidence:
- Homepage: Discord and X are the only linked social channels, so both need independent confirmation of ownership.
- Homepage: no contract address or audit reference is published to check.
- External reputation: the active malicious and suspicious detections should be re-checked for delisting before the site is revisited.
Summary Verdict
The site presents as an unverified Web3 mint page that sits in a clearly elevated-risk posture, set by an active external threat detection and compounded by the absence of an identifiable operator and verifiable contract details. Supporting indicators such as valid encryption and benign sandbox behaviour are real but cannot offset the reputational concern. Overall posture is cautionary and security-forward.
Infrastructure Integrity
The site is delivered through Fastly, a well-established content delivery network with web-application protection. All observed addresses are edge servers, and the origin host is not visible. This hosting is a mitigating factor only: it reflects reliable, mainstream delivery. It does not vouch for the project behind the content, and edge-only visibility makes it harder to confirm where the content originates or to detect a rapid swap of what is served.
Closing Assessment
Treat the site as read-only. Do not connect a wallet, sign any transaction or approval, or enter credentials, and do not interact with the mint until the operator is independently confirmed and the external detection is cleared. Anyone who has already connected a wallet should review and revoke token approvals and move valuable assets to a fresh wallet.
Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
4 findings contributed to this verdict, raised by governance, external reputation, page content, registration and ownership.
01 Governance
- What the site offers, as described on its own pages, limits how high the score can go until more of it can be verified.Governance
rule:gov_business_model_cap
02 External reputation
- A small number of malware engines flagged this domain. On its own this is a weak signal.External reputation
rule:EXT_BLACKLIST_MEDIUM
03 Page content
- The page content shows at least one warning sign that deceptive sites commonly use.Page content
rule:PAGE_RED_FLAGS_SOME - The browser raised a warning while loading the page.Page content
rule:PAGE_BROWSER_FLAGS_SUSPICIOUS - The page has no description for search engines, which established sites usually provide.Page content
rule:PAGE_SEO_MISSING_META
04 Registration and ownership
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
Signals weighed against the site
- AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 55/100 |
| Identity verification confidence | 60% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of studio-oshilabs.web.app.
- The request stayed on studio-oshilabs.web.app. It was not redirected to another domain. Clear
- It is hosted on FASTLY, from a server in US. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | FASTLY - Fastly, Inc., US |
| Country | US |
| Server IP | 2620:0:890::100 |
| Name servers | Not available |
| CDN / edge network | Detected (fastly) |
| Resolved IP addresses | 2 |
| Edge IP addresses | 2 |
| Likely origin IP addresses | 0 |
| SSL issuer | WR4 |
| SSL expiry | 2026-12-22 |
| Domain age | Not available (no registration date was returned) |
| Domain expiry | Not available |
| Archive first seen | Not available |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 1 flagged | AbuseIPDB: 3% confidence, 4 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about studio-oshilabs.web.app at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.