Is hash.horse a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website sits on a ".horse" domain, an uncommon top-level domain. When visited, it showed only a security interstitial from its edge provider titled "Suspected Phishing" (HTTP 403), with no recognisable brand, product or service content. Its commercial purpose and business model therefore cannot be established from what it shows a visitor, and the only thing the visitor sees is a warning page.

Scam/Impersonation Risk

Contradictory signals are present, and they are decisive. The domain is blacklisted. Several independent reputation engines classify it as malicious or suspicious, including two tier-one security vendors. The edge provider's own interstitial separately labels it as suspected phishing. No brand impersonation or conflicting legal-entity names were identified, but that reflects how little the site presents, not reassurance. The current domain registration is only a few months old, yet the archive shows the domain online for years earlier. That pattern is consistent with a lapsed and re-registered domain. It is context rather than proof, but it carries weight alongside the threat listings. The sandbox saw no wallet-connect prompts, clipboard tampering, hidden forms, credential posts to external hosts or fingerprinting. It did record heavy third-party request traffic, with a high share of requests leaving the domain, and many console errors. The third-party destinations were recognised ones. Even so, the page was gated behind a challenge, so this behavioural check covers a narrow surface and does not offset the reputation findings. Evidence:

• Homepage: the visit returned an edge-provider challenge page titled "Suspected Phishing" instead of site content.
• Reputation: 9 engines rated the domain malicious and 2 suspicious, including two tier-one vendors, and the domain is on an external blacklist.
• Provenance: WHOIS creation date 2026-07-29 (~0.24 years under the current registration).
• Archive: 39 snapshots spanning 2021–2026 (6 years tracked), with no content drift detected.

Regulatory Verification Notes

The visible page presents no company name, licence, registration number or legal documentation. No regulated status could be tied to the domain, and no third-party broker reputation record exists for it. The WHOIS record lists a registrant organisation, "Pav LLC", with the individual owner redacted. Nothing the site shows corroborates that name, so it cannot be treated as the verified operator. The certificate is domain-validated only. It confirms control of the domain, not the identity or legitimacy of the operator. The absence of licensing information is a verification gap rather than proof of wrongdoing, but here it sits alongside confirmed threat detections. Evidence:

• Homepage: no operator name, licence or registration disclosure is presented to the visitor.
• Registration: registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, with the owner redacted and "Pav LLC" listed as organisation.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Transport encryption: TLS certificate issued by WE1 (DV), valid to 2026-12-25.

What to Verify Next

Anyone who reached this domain through a link, message or advertisement should trace the source of that referral through an independent, trusted channel. Reaching the site directly from an unsolicited link should be treated as suspect. Any claim of affiliation with a known brand or service should be checked on that organisation's officially published domain, not through this one. If the operator later presents financial or investment services, licensing should be confirmed with the relevant national registry. Official contact channels should be confirmed by an offline route. Before any interaction, the status of the edge provider's phishing designation and of the security-vendor detections should be rechecked, because these listings can be cleared or reinstated. Evidence:

• Homepage: the edge-provider phishing interstitial is the only content observed.
• Reputation: detections from multiple engines and an external blacklist are active.
• Registration: the current registration is recent relative to the archived history.

Summary Verdict

The assessment is critical and clearly cautionary. Convergent external threat detections and a phishing designation outweigh every technical hygiene indicator present. The site presents nothing that independently establishes its identity or legitimate purpose, and no mitigating evidence offsets the reputation risk.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN/WAF with bot protection. All observed addresses are edge servers, and the origin host is not observable. The sandbox found no cloaking, which is a modest mitigating factor. Edge-only visibility prevents independent verification of the true hosting and can mask rapid content swaps. This protective infrastructure is not evidence of legitimacy and cannot offset the reputation risk.

Closing Assessment

At most, the domain should be treated as read-only. No logins, credentials, wallet connections or payments should be attempted on it. Anyone who has already entered credentials or financial details should change them immediately and monitor the affected accounts.