Is macroduck.fun a scam? TrustSniffer's high-risk assessment: 0/100

Overview

ZCAT is a newly registered, single-page website on a low-cost ".fun" domain. Its homepage is titled "ZCAT — Anonymous Cat" and presents a short block of branded, meme-style text. The page gives no clearly identifiable operator, product catalogue or service description, so its commercial purpose is not established from the captured content. The pattern is typical of a short-lived promotional or token-themed landing page.

Scam/Impersonation Risk

This site carries confirmed contradictions. Several independent threat-detection sources currently flag the domain as malicious or suspicious, and it is blacklisted by external reputation sources. That convergence is the decisive factor in the assessment, and the protective hosting layer described below does not offset it. No brand impersonation and no conflicting legal identities were observed, and no wallet-connection, wallet-draining or hidden-form behaviour appeared in the sandbox runs. The browser-behaviour tests did record that the homepage writes to the visitor's clipboard. The tests also showed that a large share of the page's network activity goes to third-party hosts, including outbound POST requests. None of those requests went to unrecognised destinations, but the clipboard write is a pattern that wallet-address-swapping schemes use. The domain's youth, its thin and very recent archive record and its sparse subdomain structure fit the profile of a disposable campaign site, and a young domain combined with confirmed detections is a recognised precursor to abuse. Taken together, the site should be treated as high-risk for any sensitive interaction. Evidence:

• Homepage: the page is titled "ZCAT — Anonymous Cat" and consists of a short text block of roughly 1,400 characters. It states no operator, product terms or service scope.
• Threat intelligence: four detection sources rate the domain malicious and one rates it suspicious, and an external blacklist listing is also active.
• Sandbox behaviour: the homepage triggers a clipboard write, and up to 92% of its network traffic goes to external hosts. Two external POST requests were seen across three successful runs.
• Domain provenance: the domain was registered on 2026-08-31 (~0.15 years old). The web archive holds only 3 snapshots, from 2026-09-11 to 2026-09-22.

Regulatory Verification Notes

The site does not state any legal entity, licence, registration number or governance information, and the captured homepage has no dedicated legal or terms pages to assess. Registrant details are incomplete, which points to ownership opacity. That opacity is an administrative limitation and not an identity contradiction. The absence of regulatory disclosure is a verification gap and is not by itself evidence of fraud. Here it adds to a profile already driven by external threat detections, so no mitigating regulatory context exists. No third-party broker or regulator profile matches this site. The site's transport encryption is valid but is only a basic domain-validated certificate. It confirms an encrypted connection and says nothing about who operates the site. Evidence:

• Homepage: no company name, licence, jurisdiction or registration number is disclosed.
• Registration record: registered through Dynadot Inc on 2026-08-31 with a one-year term, expiring 2027-08-31. Registrant details are incomplete.
• Transport encryption: the TLS certificate was issued by WE1 (domain-validated) and is valid to 2026-11-29.
• Hosting: the site is served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Before any engagement, an independent party should establish who operates the site and whether any entity stands behind the "ZCAT" name. Any claim about a token, product or community should be checked on official channels reached by an independent route, not through links on this site. If the site is linked to a token or wallet-based activity, wallet addresses and contract addresses should be compared character by character against sources outside the site. Clipboard-pasted values should not be trusted without that check. The official support and contact channels should also be confirmed offline. Where the site is being assessed for blocking or monitoring, a recheck of its threat-intelligence status after several weeks will show whether the current detections persist or are cleared. Evidence:

• Homepage: the page names no operator, so the operator must be established outside the site.
• Sandbox behaviour: the clipboard write seen on the homepage makes character-level comparison of copied addresses necessary.
• Registration record: the domain is only weeks old, so its history cannot yet confirm an established presence.

Summary Verdict

The overall posture is high-risk. Active threat-intelligence listings dominate the assessment, and the evidence base for legitimacy is thin: a very new domain, a sparse record and no verifiable operator. The site reads as a probable throwaway web property and not as an established, accountable entity.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is an edge node. The origin server could not be seen, so the real hosting location cannot be independently checked. The same masking also allows content to be swapped quickly without any visible change in hosting. The setup is mainstream and is a mitigating factor only. It offers protection against network-level attacks but does not speak to the legitimacy of the content or its operator, and it cannot offset the threat detections.

Closing Assessment

Account logins, credential entry, payments, wallet connections and any other financial interaction with this site should be avoided. If the site must be examined, read-only viewing in an isolated environment is the proportionate limit. Nothing should be downloaded from it, and no content should be copied from it for use elsewhere.