Is gachapads.pages.dev a scam? TrustSniffer's high-risk assessment: 0/100

Overview

GachaPad is a single-page crypto token-launch site on the Base network. It presents each token launch as a randomized "loot box" pull, in a Japanese gacha-machine style. A visitor sees a "Connect Wallet" control and repeated "$GACHA is live, click here to buy" banners. The page also shows a countdown to a "curated launch #001" of a second token, $LANKY, and invites visitors to stake $GACHA. Its apparent business model is a launchpad that takes a share of token-launch flow and passes part of it to $GACHA stakers. It is a new project and has no visible company, team or support presence.

Scam/Impersonation Risk

No contradictory signals were observed. There are no confirmed threat-listing hits, no phishing indicators and no conflicting legal identities. The sandboxed behavioral runs also showed no wallet-drainer activity, no clipboard manipulation, no cloaking and no credential forms. The elevated risk comes from the mechanics of the offer, not from proven malicious behavior. The homepage asks visitors to buy and stake a token through a "spin a machine, win a bag on every pull" mechanic. It asserts that "the odds are rolled by a verifiable-randomness oracle", that "nobody front-runs", and that "liquidity locks forever at graduation". It also promises "same odds on every pull", "you spin, you win", and "up to 10% of every launch flows to stakers". It offers a 30-day lock in an "early-supporter vault" for extra $GACHA, with a 350M cap. None of these claims is backed by anything on the page. It gives no contract addresses, audit, odds table, fee schedule or custody explanation. A randomized-reward purchase with undisclosed odds closely resembles gambling and blind-box sales. The "you win on every pull" framing gives no way to judge what a buyer actually receives. The page also leans on pressure tactics: the buy call-to-action is repeated in a looping banner, and a launch countdown is paired with an "Oct 7 · now" status. The countdown itself reads zero while still describing the launch as scheduled for Oct 10. That inconsistency weakens confidence in the page's own timeline. Purchases are routed to a third-party marketplace, so the page itself carries no verifiable proof of what is being sold. Evidence:

• Homepage: the "every token is a loot box" proposition, the randomness, front-running and permanent-liquidity-lock claims, and the "you spin, you win" line all appear without any supporting contract, audit or odds disclosure.
• Homepage: a looping "$GACHA is live, click here to buy" banner, a wallet-connect control, an eligibility check and a zeroed launch countdown create purchase urgency.
• Homepage: the 30-day staking vault, the 350M cap and the "up to 10% of every launch" staker share are stated as promises with no mechanics or fee terms.
• Domain observed since 2026-10-09 (~10 days old); 3 archive snapshots, all dated within 2026-10-09 to 2026-10-17 (1 year tracked), so there is no established history.

Regulatory Verification Notes

The site carries no legal-entity name, registered address, licensing or registration statement, terms of service, privacy policy or risk warning. It also lists no team members. Contact channels are absent. The page makes financial offers (token purchase, staking, and randomized pulls with unstated odds), and these are normally accompanied by such disclosures. Their absence is a disclosure gap and does not by itself prove misconduct. Here, though, it leaves the operator, the accountable party and any applicable jurisdictional protections unidentified. No third-party broker or regulatory match was found for the site. A single scanner flagged the domain as merely suspicious, with no malicious verdicts, and that signal is treated only as unconfirmed, soft reputational context. The site's real-world operator remains independently unverified. Evidence:

• Homepage: no company name, license or registration number, no jurisdiction, and no legal or terms pages are presented.
• Homepage: no contact method, address or team attribution accompanies the requests to buy, stake and connect a wallet.
• The site is served on a free subdomain of a developer-hosting platform rather than a standalone branded domain.
• Served from AS13335 (Cloudflare, US); TLS certificate issued by YE1 (DV, domain validation only), valid to 2027-01-07. A DV certificate confirms encryption, not operator identity.

What to Verify Next

Any contract address for $GACHA or $LANKY should be sourced from an independent, authoritative channel. It should not be taken from this page. Then check it on a public block explorer for supply, holder distribution, ownership and admin privileges, and liquidity-lock status. The randomness, "no front-running" and "liquidity locked forever" assertions should be checked against that on-chain evidence and any published audit. The operator should be identified through independent registry searches and by confirming official channels through an offline or otherwise independent route. The odds, fees and the staker-share formula should be requested in writing before any funds are committed. The marketplace listing the page links to should be confirmed to be the genuine, official one. Evidence:

• Homepage: the buy and stake links lead off-page, so the destination and token address must be validated outside this site.
• Homepage: no odds, fees or audit document exist on the page to verify against.
• The domain is only days old, so no earlier operating history exists to corroborate the project's claims.

Summary Verdict

The available evidence supports an elevated-risk assessment. The site is new and anonymous, and it asks for financial participation on the strength of unsupported promises. No confirmed malicious activity or identity contradiction was observed. The risk is structural, arising from missing proof and pressure-driven design. It does not rest on a proven fraud finding.

Infrastructure Integrity

The site sits behind a mainstream CDN and web application firewall, and the observed addresses are all edge servers of that provider. The transport encryption is valid and currently in date. This is a mitigating factor only. It shows ordinary, competent hosting hygiene, and it does not establish who operates the site or whether its claims are true. Edge-only visibility also means the underlying server cannot be independently verified, and content can be changed quickly without notice.

Closing Assessment

Wallet connections, token purchases and staking commitments should wait until the contract, audit, odds and operator have been independently confirmed. If any interaction is attempted before that, it should be limited to an amount that can be lost entirely, using a separate wallet that holds no other assets.