Is breadcat-fi-q50.vercel.app a scam? TrustSniffer's high-risk assessment: 21/100

Overview

This website is a single-page promotional site for a token branded "$BREADCAT", titled "Claim Rewards". It is published on a free subdomain of a shared application-hosting platform rather than on a dedicated brand domain. It presents visitors with a reward-claim proposition for a meme-style crypto token, and its apparent purpose is to draw visitors into claiming or collecting token rewards.

Scam/Impersonation Risk

Confirmed adverse reputation signals are present, and the posture here is explicitly cautionary. Several independent threat-intelligence engines currently flag the site as malicious, and a further engine marks it as suspicious. An external blacklist corroborates these detections, so the site is blacklisted rather than merely carrying a soft warning. The theme of the page compounds the concern. A "claim rewards" call to action attached to a newly branded token is a well-worn lure pattern for wallet-draining and credential-harvesting campaigns. No brand impersonation, conflicting legal identities, or phishing-page content were independently confirmed on the page, and the page text was captured but not semantically verified, so the operator's real-world identity remains unestablished. The roughly eighty abuse reports against the serving IP address are discounted. They relate to a shared content-delivery address used by many unrelated tenants and do not by themselves implicate this site. The blacklist and malicious-engine detections stand independently of them. Behavioural testing observed no wallet-connection prompts, wallet-drainer routines, clipboard tampering, hidden forms, or cloaking across the sessions run. That reduces the likelihood of an active exploit during passive viewing, but it does not offset the reputational listings, because reward-claim flows typically only trigger after a user takes an action. Evidence:

• Homepage: the page title presents a "Claim Rewards" offer for a "$BREADCAT" token, a reward-lure framing with no identifiable operator.
• Reputation checks: 3 engines classify the site as malicious and 1 as suspicious, and an external blacklist also lists it.
• Abuse database: 84 reports against the serving IP, attributed to shared CDN infrastructure and discounted (confidence score 0, whitelisted provider).
• Behavioural sandbox: 3 of 3 runs completed; no wallet-connect, drainer, clipboard-hijack, hidden-form or cloaking activity was detected.

Regulatory Verification Notes

No licence, registration, or regulated-entity status could be associated with this site. No named company, legal entity, or accountable operator was established. The site did not match any record in the third-party broker reputation dataset, so no reputational signal exists in either direction. Offering a token-reward mechanism without any identifiable issuer or registered entity is a verification gap. By itself this gap is not proof of wrongdoing, but here it sits alongside confirmed adverse listings. The site's activity patterns also show a high share of third-party requests. In the sandbox, 21 external XHR calls and 15 external POST requests were observed, and 3 XHR destinations fell outside the commonly whitelisted services. None of the POSTs went to a non-whitelisted destination. Evidence:

• Behavioural sandbox: external requests made up about 62% of traffic (36 external of 58 responses), with 3 non-whitelisted XHR destinations.
• Hosting: served from AS16509 (AMAZON-02, Amazon.com, Inc., US).
• Transport encryption: TLS certificate issued by WR1 (DV, domain validation only), valid to 2026-11-27 with 32 days remaining. DV confirms domain control only and says nothing about the operator.
• Third-party broker dataset: no match for this site.

What to Verify Next

Any claim to be associated with a genuine "BREADCAT" token should be checked through the token's officially documented channels, reached independently of this page, such as a project announcement reached from an established exchange or aggregator listing. Contract addresses should be compared against that independent source before any interaction. Where the project claims a registered issuer or a regulated activity, the named entity should be checked against the relevant public registry. No wallet connection, signature request, seed phrase entry, or token approval should be performed on this site while the threat listings remain active. Re-running reputation checks after a period would show whether the detections have been cleared. Evidence:

• Homepage: the reward-claim offer names no issuer, contract address, or documentation that could be cross-checked on the page.
• Reputation checks: the active malicious and suspicious detections remain current for this site.
• Behavioural sandbox: the 3 non-whitelisted external XHR destinations have not been attributed to any identified service.

Summary Verdict

The overall posture is high risk. Active threat-intelligence detections and a confirmed blacklist listing dominate the assessment, and the absence of any verifiable operator identity prevents any offsetting confidence. Technical hygiene, such as valid transport encryption and stable page behaviour, shows the site is functioning normally. It does not demonstrate legitimacy or safety.

Infrastructure Integrity

The site is served through Vercel's CDN and edge network on Amazon-hosted infrastructure in the United States. All eight observed IP addresses are edge servers, including the 216.198.79.x range, and no origin server was observable. This is a mitigating factor, because the platform is mainstream and its provider is established. It is not evidence of legitimacy. Edge-only visibility also prevents independent verification of what sits behind the platform and allows content to be swapped quickly. Free subdomains on shared platforms are cheap to create and replace, which weakens any continuity assurance.

Closing Assessment

Interaction beyond passive viewing is not advised. Credentials, wallet connections, signatures, and payments should be withheld entirely. Any wish to engage with the token should be redirected to independently confirmed official channels.

Signals weighed against the site

• AbuseIPDB: 84 reports on hosting IP 64.29.17.3 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.