Is theinkies.fun a scam? TrustSniffer's high-risk assessment: 18/100

Overview

INKIES is a newly launched, single-page website promoting an onchain NFT collection. Its page title advertises "4,096 manga faces, fully onchain", and the homepage carries only a short block of promotional copy. The apparent business model is the sale or minting of a fixed-supply collectible set of 4,096 generative manga-style avatars, which is a speculative digital-asset proposition.

Scam/Impersonation Risk

The site carries confirmed adverse reputation signals. Multiple independent security engines classify the domain as malicious, and a further engine rates it suspicious. A separate external blacklist also lists it, so the domain is blacklisted by more than one source. No brand impersonation, conflicting legal identities, or phishing-page behaviour were identified in the captured content, and the identity and impersonation checks produced no additional contradictions. The blacklisting is nonetheless decisive. The domain is only weeks old and has a thin history, and collection-style onchain "mint" sites are a common vehicle for wallet-drain and rug-pull campaigns. The site's central claim, that the collection is "fully onchain", is an unverifiable marketing assertion on the homepage. The collection is not recognised in DeFi protocol directories, so nothing independent supports the project's legitimacy. In the sandbox, the homepage showed no wallet-connection prompts, no wallet-draining routines, no clipboard manipulation, no hidden forms, no cloaking, and no outbound data submissions to unapproved third parties. This is a mitigating observation about the captured visit only. It does not offset the blacklisting, because a malicious mint flow can be activated or swapped in after a page is first captured. Evidence:

• The security-engine consensus on the domain is two malicious verdicts and one suspicious verdict, supported by a corroborating external blacklist entry.
• The homepage title and copy advertise "4,096 manga faces, fully onchain", with no verifiable project, team, or contract detail in the captured text.
• The behavioural sandbox ran 3 successful visits to the homepage and recorded no wallet-provider detection, no drainer activity, no clipboard writes, and no cloaking.
• The domain was registered on 2026-08-25 (~0.17 years old), so it has had very little time to build an independent track record.

Regulatory Verification Notes

The captured homepage presents no licensing, registration, or corporate-identity information. Because the offering is a digital-collectible sale, the absence of any legal entity name, terms, or jurisdictional disclosure leaves the operator unidentified. Such a gap is a verification matter in its own right, but here it compounds the reputational concerns rather than standing alone. No third-party broker or regulatory-database match exists for the domain. The site's real-world operator has not been independently established, so no claim of legitimacy can be drawn from on-site statements. The domain's registration is held behind a privacy proxy, which is treated as an administrative detail rather than an independent finding. Evidence:

• The homepage, the only page captured, lists no company name, licence, registration number, or terms of sale.
• Registered 2026-08-25 through GoDaddy.com, LLC, with registrant details held by Domains By Proxy, LLC; the registration runs to 2027-08-25.
• Served from AS13335 (Cloudflare, Inc., US); the TLS certificate is a domain-validated (DV) certificate issued by WE1, valid to 2027-01-21. DV certificates confirm domain control only, not operator identity.
• The web archive holds 2 snapshots spanning 2026-09-02 to 2026-10-12, which is a very shallow history of about one year tracked.

What to Verify Next

Any engagement should start from the position that the project is unproven. Before any interaction, a prospective participant should find out who is behind the collection, using channels independent of the site. These include a named team with a verifiable history and an official social presence that the project's own announcements link back to. Any smart-contract address the project cites should be checked on a public block explorer. The check should cover its deployment date, its verified source code, its holder distribution, and whether the supply matches the advertised 4,096. Participants should also confirm the official support and contact channels offline. Finally, the blacklist status should be re-checked with the listing sources before any decision is revisited. Evidence:

• The advertised fixed supply of 4,096 items can be checked directly against onchain records.
• The homepage names no team, company, or contract address that could be cross-referenced.
• The domain's registration is about two months old, so independent third-party coverage should be treated as absent until it is demonstrated.

Summary Verdict

The site presents an elevated-risk posture. Convergent adverse reputation from several independent sources, combined with a very young domain and an unidentified operator, outweighs the technically clean behaviour seen during the capture. The available evidence does not support treating the site as trustworthy for any sensitive or financial interaction.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a CDN edge address, so the origin host is not visible. Its transport encryption is valid, with a certificate from a known issuer and ample remaining validity. This is a mitigating factor only. Protective infrastructure is available to any operator, legitimate or not, and edge-only visibility prevents independent verification of the hosting and can mask rapid content swaps. It cannot offset the reputational risk.

Closing Assessment

The site should be treated as read-only at most. No wallet should be connected, no transaction or signature approved, no mint or purchase attempted, and no credentials or personal data entered. Anyone who has already interacted with it should review and revoke token approvals on the wallet involved and move any exposed assets.