Is hash-cats.xyz a scam? TrustSniffer's high-risk assessment: 18/100

Overview

Hashcats is a newly launched Web3 collectible site that presents itself as a "cat you have to mine". A visitor runs a browser-based proof-of-work search, pays an ETH entry price, and receives a generative pixel-cat NFT on Robinhood Chain. The page also promotes a companion $HASH token, staking, a leaderboard and documentation, so its apparent business model is the sale of mintable NFTs with a token-economy layer on top.

Scam/Impersonation Risk

The report treats this site as a high-risk property. The domain is blacklisted by an external threat-intelligence aggregation, and the page content shows several fraud-pattern indicators. No brand impersonation, phishing form or conflicting legal identities were observed, so the concern is the blacklisting combined with the economic design of the offer. The homepage describes an open-ended mint with "no allowlist and no supply cap". Its price is set by a rising difficulty and streak system, and the entry price shown was about 0.026 ETH per cat. The page boasts that traits are chosen by the hash, "including us". It also describes a $HASH token that is minted on burn. Thirty percent of every mint and five percent of swap fees are said to fund buybacks and burns, and holders are promised "rent" from later mints. That is a yield-like return funded by new entrants, and the page backs it with no contract address, audit reference, team or legal identity, or risk disclosure. The headline counters (a mined total of tens of millions and nearly ten thousand cats minted) cannot be independently confirmed from the page. Taken together, these features give the site the structure of a high-risk token project with an opaque value flow. The visible mechanics are consistent with a speculative, pay-to-enter scheme in which returns depend on continued new minting. Sandbox testing found no wallet-drainer behaviour, clipboard hijacking, hidden forms or cloaking, which limits but does not offset the reputational and economic concerns. Evidence:

• Domain registered 2026-09-21 (~0.08 years, about 30 days old) through Dynadot Inc.
• Web archive holds only 3 snapshots, from 2026-09-21 to 2026-09-29, so there is no meaningful operating history.
• Homepage advertises an entry price of about 0.026368 ETH, a difficulty of 35 bits, and a 30% mint / 5% swap-fee buyback-and-burn scheme for $HASH.
• Homepage promises holder "rent" from later mints without a contract address, audit or team disclosure.
• Threat-intelligence aggregation returned one malicious and one suspicious detection against the domain.

Regulatory Verification Notes

The homepage names no operating company, jurisdiction, licence, registration number or responsible individual. It also carries no terms of service, privacy policy or risk warning. For a service that takes ETH payments and describes yield-like holder distributions, that omission is material to the assessment, and the operator's real-world identity remains unverified. No broker or regulator-database record matched this domain, so there is no third-party regulatory context either way. The absence of disclosures is a verification gap in its own right. The blacklisting is the confirmed contradiction behind the cautionary posture. Evidence:

• Homepage shows no company name, licence or registration reference, and no legal or terms pages were found.
• Homepage gives no team or operator identity and no audit reference.
• Domain registered 2026-09-21 and expiring 2027-09-21, a one-year term typical of a newly created property.
• Site served from AS13335 (Cloudflare), with a TLS certificate issued by YE2 (DV), valid to 2026-12-20.

What to Verify Next

Any contract the site refers to should be located through independent channels and checked on a block explorer. The checks should cover verified source code, upgrade and admin permissions, fee-routing logic and whether the "rent" payouts actually exist on-chain. Any official project channels, team members or audit reports should be confirmed through an independent route and not through links on the site itself. Before any funds are committed, the operator's legal identity and jurisdiction should be established. The status of the external blacklisting should be re-checked to see whether the listing is cleared or remains active. Evidence:

• Homepage describes a minting contract, but no contract address was published.
• Homepage promises holder rent and token buybacks with no supporting documentation on the page.
• Domain only about 30 days old, with minimal archive history to cross-check claims against.

Summary Verdict

The overall posture is elevated risk. A confirmed external blacklisting, a very young domain, an unverified operator and a yield-style token economy without verifiable backing converge on a cautionary conclusion. The technically clean browser behaviour and valid encryption show basic site hygiene, but they do not establish trustworthiness or offset the reputational and economic concerns.

Infrastructure Integrity

The site is fronted by Cloudflare (AS13335) and resolves only to CDN edge addresses, so the true origin server is not observable. A valid DV certificate is in place. This is a mitigating factor for transport security only. It does not verify the operator and cannot offset the reputational findings. Edge-only visibility also means the underlying content could be changed quickly without outside detection. The domain's age and sparse subdomain footprint are consistent with a freshly stood-up deployment.

Closing Assessment

The site should be limited to read-only viewing. No wallet connection, ETH payment, minting, staking or credential entry should occur, and no funds should be committed until the operator is independently identified and the blacklisting is resolved.