--- title: "Is hash-cats.xyz a Scam? Trust Score 18/100" source: TrustSniffer type: Website trust & fraud report subject: "hash-cats.xyz" verdict: "Critical Risk" title: "Is hash-cats.xyz a Scam? Risk Report, Score 18/100" trust_score: 18 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/hash-cats.xyz assessed: 2026-10-21 --- # Is hash-cats.xyz a scam? TrustSniffer's high-risk assessment: 18/100 ## Verdict **Verdict: Critical Risk, trust score 18/100.** hash-cats.xyz shows high-risk / scam indicators. This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-21 by automated analysis. Classification confidence 75%. | Field | Value | | --- | --- | | What this site appears to be | Hashcats is a Web3 site on Robinhood Chain where users run a browser proof-of-work search, pay an ETH entry price, and receive a generative pixel cat NFT. The page also describes a $HASH token that is minted on burn and bought back with mint and swap fees, and it promises holder rent without giving a contract address, audit, or operator identity. | ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 1 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear | | Domain age | 29 days old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2026 (3 snapshots) | Clear | | Certificate | Encrypted connection (Issued by YE2) | Noted | ## The page as captured ![Screenshot of the hash-cats.xyz homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/hash-cats.xyz/screenshots/first.png) _What hash-cats.xyz served when TrustSniffer captured it on 2026-10-21. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2026. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Overview Hashcats is a newly launched Web3 collectible site that presents itself as a "cat you have to mine". A visitor runs a browser-based proof-of-work search, pays an ETH entry price, and receives a generative pixel-cat NFT on Robinhood Chain. The page also promotes a companion $HASH token, staking, a leaderboard and documentation, so its apparent business model is the sale of mintable NFTs with a token-economy layer on top. ### Scam/Impersonation Risk The report treats this site as a **high-risk property**. The domain is **blacklisted** by an external threat-intelligence aggregation, and the page content shows several fraud-pattern indicators. No brand impersonation, phishing form or conflicting legal identities were observed, so the concern is the blacklisting combined with the economic design of the offer. The homepage describes an open-ended mint with "no allowlist and no supply cap". Its price is set by a rising difficulty and streak system, and the entry price shown was about 0.026 ETH per cat. The page boasts that traits are chosen by the hash, "including us". It also describes a $HASH token that is minted on burn. Thirty percent of every mint and five percent of swap fees are said to fund buybacks and burns, and holders are promised "rent" from later mints. That is a yield-like return funded by new entrants, and the page backs it with no contract address, audit reference, team or legal identity, or risk disclosure. The headline counters (a mined total of tens of millions and nearly ten thousand cats minted) cannot be independently confirmed from the page. Taken together, these features give the site the structure of a high-risk token project with an opaque value flow. The visible mechanics are consistent with a speculative, pay-to-enter scheme in which returns depend on continued new minting. Sandbox testing found no wallet-drainer behaviour, clipboard hijacking, hidden forms or cloaking, which limits but does not offset the reputational and economic concerns. Evidence: - Domain registered 2026-09-21 (~0.08 years, about 30 days old) through Dynadot Inc. - Web archive holds only 3 snapshots, from 2026-09-21 to 2026-09-29, so there is no meaningful operating history. - Homepage advertises an entry price of about 0.026368 ETH, a difficulty of 35 bits, and a 30% mint / 5% swap-fee buyback-and-burn scheme for $HASH. - Homepage promises holder "rent" from later mints without a contract address, audit or team disclosure. - Threat-intelligence aggregation returned one malicious and one suspicious detection against the domain. ### Regulatory Verification Notes The homepage names no operating company, jurisdiction, licence, registration number or responsible individual. It also carries no terms of service, privacy policy or risk warning. For a service that takes ETH payments and describes yield-like holder distributions, that omission is material to the assessment, and the operator's real-world identity remains unverified. No broker or regulator-database record matched this domain, so there is no third-party regulatory context either way. The absence of disclosures is a verification gap in its own right. The blacklisting is the confirmed contradiction behind the cautionary posture. Evidence: - Homepage shows no company name, licence or registration reference, and no legal or terms pages were found. - Homepage gives no team or operator identity and no audit reference. - Domain registered 2026-09-21 and expiring 2027-09-21, a one-year term typical of a newly created property. - Site served from AS13335 (Cloudflare), with a TLS certificate issued by YE2 (DV), valid to 2026-12-20. ### What to Verify Next Any contract the site refers to should be located through independent channels and checked on a block explorer. The checks should cover verified source code, upgrade and admin permissions, fee-routing logic and whether the "rent" payouts actually exist on-chain. Any official project channels, team members or audit reports should be confirmed through an independent route and not through links on the site itself. Before any funds are committed, the operator's legal identity and jurisdiction should be established. The status of the external blacklisting should be re-checked to see whether the listing is cleared or remains active. Evidence: - Homepage describes a minting contract, but no contract address was published. - Homepage promises holder rent and token buybacks with no supporting documentation on the page. - Domain only about 30 days old, with minimal archive history to cross-check claims against. ### Summary Verdict The overall posture is **elevated risk**. A confirmed external blacklisting, a very young domain, an unverified operator and a yield-style token economy without verifiable backing converge on a cautionary conclusion. The technically clean browser behaviour and valid encryption show basic site hygiene, but they do not establish trustworthiness or offset the reputational and economic concerns. ### Infrastructure Integrity The site is fronted by Cloudflare (AS13335) and resolves only to CDN edge addresses, so the true origin server is not observable. A valid DV certificate is in place. This is a mitigating factor for transport security only. It does not verify the operator and cannot offset the reputational findings. Edge-only visibility also means the underlying content could be changed quickly without outside detection. The domain's age and sparse subdomain footprint are consistent with a freshly stood-up deployment. ### Closing Assessment The site should be limited to read-only viewing. No wallet connection, ETH payment, minting, staking or credential entry should occur, and no funds should be committed until the operator is independently identified and the blacklisting is resolved. _Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 4 findings contributed to this verdict, raised by external reputation, page content, hosting and network, history in the web archive. ### 01 External reputation - A small number of malware engines flagged this domain. On its own this is a weak signal. (External reputation `rule:EXT_BLACKLIST_MEDIUM`) ### 02 Page content - The page shows few of the signs expected from a trustworthy operator. (Page content `rule:PAGE_TRUST_QUALITY_LOW`) - The page content shows three or more warning signs that deceptive sites commonly use. (Page content `rule:PAGE_RED_FLAGS_STRONG`) - The page content shows at least one warning sign that deceptive sites commonly use. (Page content `rule:PAGE_RED_FLAGS_SOME`) ### 03 Hosting and network - The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`) ### 04 History in the web archive - The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`) ## Identity verification | Field | Value | | --- | --- | | Status | UNVERIFIED | | Identity score | 30/100 | | Identity verification confidence | 50% | - No on-site identity signals detected _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of hash-cats.xyz. - The request stayed on hash-cats.xyz. It was not redirected to another domain. (Clear) - Registration is published under Dynadot Inc. (Clear) - DNS for this domain is served by cloudflare.com, across 2 name servers. (Noted) - The registration is paid up to 2027-09-21. (Noted) - The earliest public archive of this site is from 2026-09-21. (Clear) - It is hosted on CLOUDFLARENET, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Dynadot Inc | | Hosting | CLOUDFLARENET - Cloudflare, Inc., US | | Country | US | | Server IP | 2606:4700:3037::ac43:89c1 | | Name servers | ABBY.NS.CLOUDFLARE.COM, HAYES.NS.CLOUDFLARE.COM | | CDN / edge network | Detected (cloudflare) | | Resolved IP addresses | 4 | | Edge IP addresses | 4 | | Likely origin IP addresses | 0 | | SSL issuer | YE2 | | SSL expiry | 2026-12-20 | | Domain age | 0.08 years (continuous registration) | | Domain expiry | 2027-09-21 | | Archive first seen | 2026-09-21 | | Archive snapshots | 3 | | Reputation | VirusTotal: 1 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about hash-cats.xyz at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [pumpfunsecuingnow.xyz](https://trustsniffer.com/report/pumpfunsecuingnow.xyz), another .xyz site assessed as critical-risk (Critical Risk, 0/100) - [amemecoin.xyz](https://trustsniffer.com/report/amemecoin.xyz), another .xyz site assessed as critical-risk (Critical Risk, 0/100) - [hyperfoundationsnapshots.xyz](https://trustsniffer.com/report/hyperfoundationsnapshots.xyz), another .xyz site assessed as critical-risk (Critical Risk, 0/100) - [whitelisst.xyz](https://trustsniffer.com/report/whitelisst.xyz), another .xyz site assessed as critical-risk (Critical Risk, 0/100) - [jumperreward.xyz](https://trustsniffer.com/report/jumperreward.xyz), another .xyz site assessed as critical-risk (Critical Risk, 0/100) - [bitcoinhyper-live.xyz](https://trustsniffer.com/report/bitcoinhyper-live.xyz), another .xyz site assessed as critical-risk (Critical Risk, 0/100) - [syntax-pages.xyz](https://trustsniffer.com/report/syntax-pages.xyz), another .xyz site assessed as critical-risk (Critical Risk, 0/100) - [earn-venanta.xyz](https://trustsniffer.com/report/earn-venanta.xyz), another .xyz site assessed as critical-risk (Critical Risk, 0/100) - [pendlefinance.asia](https://trustsniffer.com/report/pendlefinance.asia), another site assessed as critical-risk (Critical Risk, 0/100) - [packscan.cc](https://trustsniffer.com/report/packscan.cc), another site assessed as critical-risk (Critical Risk, 0/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Stablecoin Freezes, Oct 26, 2026: 11 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-26) - [99.5% of flagged USDT wallets were frozen](https://trustsniffer.com/blog/99-5-of-flagged-usdt-wallets-were-frozen) - [Trading Platform Scam: Checking a Blocked Balance](https://trustsniffer.com/blog/trading-platform-scam-checking-a-blocked-balance) --- *Source: [TrustSniffer](https://trustsniffer.com/report/hash-cats.xyz) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/hash-cats.xyz · assessed 2026-10-21.*