Is cashcat-live.com a scam? TrustSniffer's high-risk assessment: 0/100

Overview

Cashcat-live.com is a single-page website titled "Cash Cat | Community Airdrop Claim · Robinhood". It presents itself as a token or crypto-reward "community airdrop" claim portal, and it places the name of a well-known retail brokerage in its title. Its apparent purpose is to draw visitors into claiming a promotional crypto giveaway. That is a business model commonly associated with credential-harvesting and wallet-interaction lures, though the page offered no independently verifiable operator behind it.

Scam/Impersonation Risk

The evidence shows confirmed adverse reputation and a profile consistent with a short-lived lure. Multiple independent threat-intelligence engines currently flag the domain as malicious, with a further engine rating it suspicious. The site is therefore blacklisted through confirmed external detections. The domain was registered only weeks before this analysis, and its subdomain footprint is sparse for a site making grand-scale claims. The homepage pairs a "community airdrop claim" with a major brokerage's name. That is a brand-association pattern typical of airdrop lures, though the evidence does not establish a specific impersonation finding or a conflicting legal identity. The behavioral sandbox observed no wallet-connection prompts, wallet-drainer activity, clipboard manipulation, hidden forms, or externally posted password fields. Nearly all of the page's network activity went to external destinations, with dozens of outbound requests and POST submissions. The sandbox classed these as known endpoints, and there were repeated browser console errors. A clean sandbox run does not offset the reputation findings, because airdrop-claim pages can change behavior once a visitor engages. Evidence:

• Homepage title advertises a "Community Airdrop Claim" under a well-known brokerage's name; the page's visible text is brief and promotional.
• Domain registered 2026-08-31 (~0.15 years, 55 days old), registered through NameSilo, LLC with a privacy-protected registrant, expiring 2027-08-31.
• Two threat-intelligence engines rate the domain malicious and one rates it suspicious, with a corroborating external blacklist entry.
• Sandbox: 27 external XHR/fetch calls and 9 external POSTs, about 97.6% of observed requests directed off-domain, 12 console errors; no wallet-connect, drainer, clipboard-hijack, or hidden-form activity.

Regulatory Verification Notes

The pages examined disclose no licensing, registration, or regulatory status, and the on-page disclosure position is unclear. A site that invites participation in a financial-style crypto giveaway, in a brand's name, would be expected to identify an accountable legal entity and any relevant authorisation. No such disclosure was found. Real-world operator identity remains unverified, and no regulator or third-party broker-rating source was matched. This is a verification gap and not proof of wrongdoing on its own, but alongside the adverse reputation findings it removes any basis for treating the site as an authorised or regulated service. The site's transport encryption is valid but is only domain-validated, so it confirms an encrypted connection and says nothing about who operates the site. Evidence:

• No licence, company name, or registration number was found on the homepage.
• Served from AS13335 (Cloudflare, Inc., US).
• TLS certificate issued by WE1 (DV), valid to 2026-11-29.
• No match in the third-party broker-reputation dataset.

What to Verify Next

Any claim that the airdrop is connected to the brokerage named in the page title should be checked only through that company's own official website, app, or announcements, reached independently of this site. The brokerage's official support channel can confirm whether it runs or endorses any such programme. Anyone who has already interacted with the page should review wallet approvals and revoke any unfamiliar permissions, change any reused passwords, and report the site to the brand being invoked and to the relevant anti-abuse channels. Organisations should check whether the domain appears in their own mail, ad, or social-media traffic. Evidence:

• Homepage airdrop-claim framing under a third-party brand name is the claim to confirm with that brand.
• The domain's registration is weeks old, so no established relationship with the named brand can be assumed.
• Current external detections make independent confirmation a precondition for any further engagement.

Summary Verdict

The site carries an elevated, clearly cautionary risk posture. Confirmed external detections, a very new domain, and a claim-your-airdrop proposition that borrows a major brand's name converge to outweigh the site's technically sound baseline. Its legitimacy cannot be supported, and the operator's identity remains unverified.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and all observed addresses are CDN edge servers, so the underlying hosting origin could not be independently observed. That edge-only view limits verification of where content is served from and can mask rapid content changes. Cloudflare's bot-protection layer was active during testing. This protection is a mitigating factor only and does not offset the reputation findings.

Closing Assessment

The site should not be used for account login, credential entry, wallet connection, or any payment or financial action. Viewing it passively is the only reasonable interaction. Any airdrop or reward claim should be pursued only through the official channels of the brand concerned.