--- title: "Is hashcatnft.xyz Safe? Risk Report, Score 27/100" source: TrustSniffer type: Website trust & fraud report subject: "hashcatnft.xyz" verdict: "Low Trust" title: "Is hashcatnft.xyz Safe? Warning Signs, Score 27/100" trust_score: 27 classification_confidence: 75 canonical_url: https://trustsniffer.com/report/hashcatnft.xyz assessed: 2026-10-21 --- # Is hashcatnft.xyz safe? TrustSniffer's low-trust assessment: 27/100 ## Verdict **Verdict: Low Trust, trust score 27/100.** hashcatnft.xyz is low-trust and potentially risky. Several risk patterns were present. Do not send money or personal details until you have verified this business another way. Labels: Sensitive Interaction Risk, Governance Risk Assessed 2026-10-21 by automated analysis. Classification confidence 75%. | Field | Value | | --- | --- | | What this site appears to be | Hashcats is a Web3 landing page for an on-chain, proof-of-work NFT mint on Robinhood Chain. Users pay an ETH entry price per cat, and the page describes $HASH token burns and holder rent funded by later mints. The page gives no visible contract address, audit, legal entity, or contact channel to verify these claims. | ## Evidence status and limitations Evidence completeness: Not recorded - The real-world operator identity was not independently verified. - Module-level completeness metadata is unavailable for this legacy report. ## At a glance The checks that decide most of this verdict. | Check | Result | Status | | --- | --- | --- | | Malware engines | 1 flagged it (VirusTotal) | Risk | | Google Safe Browsing | Not listed (Google) | Clear | | Abuse reports on the host | 0% confidence (AbuseIPDB, 0 reports; shared hosting inflates reports) | Clear | | Domain age | 29 days old (Most scam domains are under a year old) | Risk | | Web archive | Archived since 2026 (3 snapshots) | Clear | | Certificate | Encrypted connection (Issued by YE1) | Noted | ## The page as captured ![Screenshot of the hashcatnft.xyz homepage captured during the TrustSniffer assessment](https://trustsniffer.com/outputs/hashcatnft.xyz/screenshots/first.png) _What hashcatnft.xyz served when TrustSniffer captured it on 2026-10-21. The page may look different now._ ## Key findings - Automated classification: Sensitive Interaction Risk. - Domain age: less than 1 year (registration continuity). - Public web-archive history exists since 2026. - At least one reputation service TrustSniffer consulted had flagged this domain at assessment time. ## Full analysis ### Overview Hashcats is a Web3 landing page for a proof-of-work NFT mint on Robinhood Chain. Its tagline is "a cat you have to mine". The homepage presents generative pixel-cat collectibles, a live mining dashboard, and navigation to collection, token, staking, leaderboard and documentation sections. A visitor connects a wallet and pays an ETH entry price to a contract to mint a cat, with a companion token and holder rewards layered on top. The apparent business model is revenue from successive mints, with token-based incentives to encourage continued participation. ### Scam/Impersonation Risk The site is currently **blacklisted** by external threat-reputation sources, which is a confirmed contradiction that places the assessment in a clearly cautionary, high-risk posture. The homepage shows no brand impersonation, no login form, no seed-phrase request and no credential-harvesting form. The risk therefore lies in the economics and the reputation signal, not in a cloned interface. The domain is also only weeks old, so it has no track record to offset the listing. The homepage describes a mint with no allowlist and no supply cap, at an entry price of 0.026368 ETH in the current epoch. It states that 30% of each mint plus 5% of swaps buy and burn the $HASH token, that burning a cat mints $HASH, and that holders receive "rent" funded by later mints. Rewards that depend on a continuing inflow of new minters are structurally dependent on new entrants. The homepage also shows a mined counter in the tens of millions and a "to the wall" supply progress indicator. Nothing on the page substantiates either figure. It publishes no contract address, audit, legal entity or contact channel, so a visitor cannot independently confirm where funds go or how the burn and rent mechanics are enforced. Together, the listing, the opaque value flow and the wallet-connection prompt make any funds-moving interaction on this site high-risk. Evidence: - Homepage: the entry price, the 30% mint and 5% swap allocations to buying and burning $HASH, and the "rent funded by later mints" claim are all stated without any verifiable contract reference. - Homepage: the page publishes no contract address, audit, legal entity or contact channel. - External reputation checks: one security engine rated the domain malicious and a second rated it suspicious, which triggered the blacklist classification. - Domain registered 2026-09-21 (~0.08 years, about 30 days old), with 3 archive snapshots in 2026 (first 2026-09-21, last 2026-09-29; 1 year tracked). ### Regulatory Verification Notes The homepage identifies no operating company, jurisdiction, licence, registration number, terms of service or risk disclosure, even though it solicits ETH payments and promotes a token with reward mechanics. For a high-stakes financial product, that omission is a verification gap. It is not itself proof of wrongdoing, but here it compounds the confirmed reputation listing. No licence is claimed or verified. Ownership and governance are also opaque, because nothing on the site connects it to an accountable person or entity. No third-party broker or regulatory-database record was matched, so no external reputational context exists to offset these gaps. The project is also not recognised in any DeFi analytics registry. Evidence: - Homepage: no company name, licence, jurisdiction, legal pages or risk disclosure appear anywhere in the captured content. - Domain registered through Dynadot Inc on 2026-09-21, with expiry set for 2027-09-21. - TLS certificate issued by YE1 (DV, domain validation only), valid to 2026-12-20. This confirms encryption only, not operator identity. - Served from AS13335 (Cloudflare, US). The project is not listed in DeFiLlama, so no TVL data exists. ### What to Verify Next Any claim must be checked outside the site. The contract address must be found through an independent route and inspected on the Robinhood Chain block explorer. That check should confirm the deployed code, ownership and admin privileges, and whether the burn and rent logic matches the homepage description. A published audit from a named firm should be located and confirmed with the firm directly. The identity of the operating team should be established through channels the site does not control. The listing status should be rechecked with the reporting security engines, since a delisting or a false-positive determination would change the assessment. Official support and social channels should also be confirmed through an independent, offline route before any communication. Evidence: - Homepage: no contract address is shown, so the on-chain claims cannot currently be matched to a deployed contract. - Homepage: the page lists a Docs section in its navigation, but the captured content does not provide an audit or legal reference to cross-check. - External reputation checks: the active listing is the first item to be rechecked for status changes. ### Summary Verdict The site carries an elevated-risk posture. A confirmed reputation listing, a very recent domain, an unsubstantiated reward-driven financial model and no identifiable operator converge on a cautionary assessment. The valid certificate and clean page behaviour (no credential capture, no cloaking, no wallet-drainer activity observed) are mitigating, but they do not offset the adverse indicators. ### Infrastructure Integrity The site is fronted by Cloudflare's CDN and WAF, and all observed addresses are edge servers, so the origin host cannot be independently identified. This protection is a mitigating factor only. It prevents independent hosting verification and can mask rapid content changes, and it provides no assurance about the operator or the legitimacy of the content. The young domain with sparse subdomains is an unconfirmed heuristic, not a finding. ### Closing Assessment Treat the site as unsuitable for wallet connection, payments, or any login or financial interaction. Limit engagement to read-only viewing until the operator is identified, the contract is independently verified, and the external listing is cleared. _Written analysis generated 2026-10-21 by the TrustSniffer Analysis Engine from the evidence in this report._ ## What the analysis found 4 findings contributed to this verdict, raised by external reputation, page content, hosting and network, history in the web archive. ### 01 External reputation - A small number of malware engines flagged this domain. On its own this is a weak signal. (External reputation `rule:EXT_BLACKLIST_MEDIUM`) ### 02 Page content - The page content shows three or more warning signs that deceptive sites commonly use. (Page content `rule:PAGE_RED_FLAGS_STRONG`) - The page content shows at least one warning sign that deceptive sites commonly use. (Page content `rule:PAGE_RED_FLAGS_SOME`) - The browser raised a warning while loading the page. (Page content `rule:PAGE_BROWSER_FLAGS_SUSPICIOUS`) ### 03 Hosting and network - The domain was registered less than three months ago. (Hosting and network `rule:DNS_NEW_DOMAIN_90D`) ### 04 History in the web archive - The web archive has almost no record of this domain, which fits a site that is new. (History in the web archive `rule:ARCH_PEN_YOUNG_AND_SPARSE`) ## Identity verification | Field | Value | | --- | --- | | Status | UNVERIFIED | | Identity score | 30/100 | | Identity verification confidence | 50% | - No on-site identity signals detected _Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence._ ## What TrustSniffer observed First-party facts recorded during the assessment of hashcatnft.xyz. - The request stayed on hashcatnft.xyz. It was not redirected to another domain. (Clear) - Registration is published under Dynadot Inc. (Clear) - DNS for this domain is served by cloudflare.com, across 2 name servers. (Noted) - The registration is paid up to 2027-09-21. (Noted) - The earliest public archive of this site is from 2026-09-21. (Clear) - It is hosted on CLOUDFLARENET, from a server in US. (Noted) ## Domain intelligence | Field | Value | | --- | --- | | Registrar | Dynadot Inc | | Hosting | CLOUDFLARENET - Cloudflare, Inc., US | | Country | US | | Server IP | 2606:4700:3035::6815:5f57 | | Name servers | ABBY.NS.CLOUDFLARE.COM, HAYES.NS.CLOUDFLARE.COM | | CDN / edge network | Detected (cloudflare) | | Resolved IP addresses | 4 | | Edge IP addresses | 4 | | Likely origin IP addresses | 0 | | SSL issuer | YE1 | | SSL expiry | 2026-12-20 | | Domain age | 0.08 years (continuous registration) | | Domain expiry | 2027-09-21 | | Archive first seen | 2026-09-21 | | Archive snapshots | 3 | | Reputation | VirusTotal: 1 flagged \| AbuseIPDB: 0% confidence, 0 reports \| Google Safe Browsing: 0 matches | ## About this assessment **Was this report useful?** Tell other people what you think of TrustSniffer, good or bad. An honest review helps others decide whether to rely on these checks. [Review TrustSniffer on Trustpilot](https://www.trustpilot.com/review/trustsniffer.com) A trust score summarises the evidence TrustSniffer could collect about hashcatnft.xyz at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present. TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed. ## Related on TrustSniffer - [tierlane.xyz](https://trustsniffer.com/report/tierlane.xyz), another .xyz site assessed as low-trust (Low Trust, 44/100) - [fomies.xyz](https://trustsniffer.com/report/fomies.xyz), another .xyz site assessed as low-trust (Low Trust, 29/100) - [solstreaming.xyz](https://trustsniffer.com/report/solstreaming.xyz), another .xyz site assessed as low-trust (Low Trust, 41/100) - [solution-interfaces.xyz](https://trustsniffer.com/report/solution-interfaces.xyz), another .xyz site assessed as low-trust (Low Trust, 30/100) - [papertrade-vote.xyz](https://trustsniffer.com/report/papertrade-vote.xyz), another .xyz site assessed as low-trust (Low Trust, 30/100) - [votes-papertrade.xyz](https://trustsniffer.com/report/votes-papertrade.xyz), another .xyz site assessed as low-trust (Low Trust, 30/100) - [flapsh-allocations.xyz](https://trustsniffer.com/report/flapsh-allocations.xyz), another .xyz site assessed as low-trust (Low Trust, 28/100) - [saturnreward.xyz](https://trustsniffer.com/report/saturnreward.xyz), another .xyz site assessed as low-trust (Low Trust, 25/100) - [trumpmaga-dic.pages.dev](https://trustsniffer.com/report/trumpmaga-dic.pages.dev), another site assessed as low-trust (Low Trust, 48/100) - [multiprotocoltoken.pro](https://trustsniffer.com/report/multiprotocoltoken.pro), another site assessed as low-trust (Low Trust, 38/100) - [Every website and wallet TrustSniffer has assessed](https://trustsniffer.com/directory), the full risk directory - [Other domains assessed as high-risk or phishing](https://trustsniffer.com/directory/phishing-domains), same verdict band - [Check another website](https://trustsniffer.com/web-intelligence), run a new assessment - [Check a crypto wallet address](https://trustsniffer.com/on-chain-risk), on-chain screening - [The TrustSniffer Risk Index](https://trustsniffer.com/stats), how this verdict compares ## Guides - [Stablecoin Freezes, Oct 24, 2026: 15 Wallets](https://trustsniffer.com/blog/stablecoin-freeze-report-2026-10-24) - [Fake Airdrop Sites Show a Number, Not a Transfer](https://trustsniffer.com/blog/fake-airdrop-sites-show-a-number-not-a-transfer) - [Crypto Scam Websites in 2026: What a List Misses](https://trustsniffer.com/blog/crypto-scam-websites-2026-what-a-list-misses) --- *Source: [TrustSniffer](https://trustsniffer.com/report/hashcatnft.xyz) — independent automated trust & fraud analysis. Cite as https://trustsniffer.com/report/hashcatnft.xyz · assessed 2026-10-21.*