trenchcoat
Free · no sign-up
Website report · 25 min ago

wizzard.fun

“WIZZARD · NFT Dungeon RPG”

Template-written 40 evidence items Code reader analysed 7 scripts
What this means for you

wizzard.fun talked to 3 outside services on a first visit, including 1 that measures visits or shows ads.E5

  • An AI agent used the site and saw 0 of 1 claimed features working.E39
  • Wallet connection: Clicking CONNECT WALLET made a call to /api/captcha and opened a wallet picker listing Phantom, Solflare and MetaMask (Solana). Actually connecting a wallet is blocked in this sandbox, so I could not see the connection complete.E39
  • Also noticed, /play behind Cloudflare check: Going to /play showed only a Cloudflare security verification page, so the game page never loaded.E40
  • Tech check: the site claims wallet connection, and its public page shows matching evidence.E36E9E10E11
  • Before you click anything, the page loads analytics or ad services: Cloudflare Web Analytics.E5
  • 1 cookie was set in your browser, all by the site itself.E7
  • Its code can ask your wallet to sign transactions. Read every wallet pop-up before approving.E35

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Evidence found

Wallet connection

“…Get started 🇬🇧 CREATORS PLAY NOW LIVE NOW · ON SOLANA CONNECT WALLET REFERRAL BUY TOKENsoon DISCORD PRE-REGISTRATION Secure…”E36

Wallet libraries in its code: web3.js, Solana web3 / wallet adapter, PhantomE9E10E11

Wallet requests in its code: signTransaction, personal_sign, eth_requestAccountsE35E34E33

Calls its own backend /api/health, /api/captchaE15E16
Wallet code web3.js, Solana web3 / wallet adapter, PhantomE9E10E11E35
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

What the AI agent tried

An AI agent (claude-opus-5-5) used the site in our sandbox for 3 steps and saw 0 of 1 claimed feature working. It can't connect a wallet, pay, sign or log in, so those features count as "couldn't test". What it reports is what it observed, not a verdict.

Couldn't test

Wallet connection

Clicking CONNECT WALLET made a call to /api/captcha and opened a wallet picker listing Phantom, Solflare and MetaMask (Solana). Actually connecting a wallet is blocked in this sandbox, so I could not see the connection complete.E39

Also noticed

Things the agent saw along the way that aren't among the site's claims. Not counted above.

Noticed

/play behind Cloudflare check

Going to /play showed only a Cloudflare security verification page, so the game page never loaded.E40

What it is

  • The Internet Archive first saved this site on 2026-10-27 (13 days ago).E37
  • The site describes itself as: “Summon NFT heroes, send them into the dungeon and earn the game token. Own every hero in your wallet, fuse them, max their skills and climb ”E2
  • In your browser it can copy text to your clipboard and saves small bits of data in your browser.E12E13
  • It has sections such as /creators and /play.E32
  • While loading, it called 2 endpoints on its own servers, such as /api/health and /api/captcha.E15E16

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 1
static.cloudflareinsights.comCloudflare Web Analytics: page-view counter 1×E5
FontsDownload typefaces. 2
fonts.gstatic.comGoogle Fonts: fonts 3×E6
fonts.googleapis.comGoogle Fonts: fonts 1×E4

Crypto and wallets

  • Wallet tools in the code: web3.js, Solana web3 / wallet adapter and Phantom.E9E10E11
  • signTransaction: asks a wallet to sign transactions (often Solana wallets).E35
  • personal_sign: asks you to sign a text message (often to log in; moves no funds by itself).E34
  • eth_requestAccounts: asks to connect your wallet, which shows the site your address.E33

How key features work

What it can ask your wallet to sign

Its code can ask your wallet for signTransaction. Each of these opens a wallet pop-up you must approve; read it before you click.E35

signTransaction

Connecting your wallet

It connects to crypto wallets using web3.js, Solana web3 / wallet adapter, Phantom, signTransaction and 2 more. Connecting shows the site your wallet address; it doesn't move funds by itself.E9E10E11E33

web3.jsSolana web3 / wallet adapterPhantomsignTransactionpersonal_signeth_requestAccounts

Sign-in and accounts

Sign-in and account features show up in its code or traffic (/api/account, /api/account/sign-out, /api/x/login and /api/discord/login).E18E19E21

/api/account/api/account/sign-out/api/x/login/api/discord/login

Loading its content

Its content loads from its own API while you browse (/api/health and /api/captcha).E15E16

/api/health/api/captcha

Drawing and editing in the browser

The page draws and edits graphics in your browser using the canvas.E14

canvas

Measuring what you do

Visits and clicks are measured with Cloudflare Web Analytics (found in its traffic or its code).E5

Cloudflare Web Analytics

Saving data on your device

It saves data in your browser (localStorage), so some things persist between visits.E13

local_storage

Cookies and storage

Names only. We never store the values.

CookieSet forKeptWhose
cf_clearanceE7wizzard.fun about 365 daysthe site

Pages and API calls

Pages it links to

//creators/play

Endpoints

Called while loading (seen) or named in the code (code).

wizzard.fun/api/healthseenE15
wizzard.fun/api/captchaseenE16
/api/captchacodeE17
/api/accountcodeE18
/api/account/sign-outcodeE19
/api/referralscodeE20
/api/x/logincodeE21
/api/discord/logincodeE22
/api/quest/claimcodeE23
/api/profile/nickname-initcodeE24
/api/healthcodeE25
/api/i18ncodeE26
/api/wallet/challengecodeE27
/api/wallet/sign-incodeE28
/api/evm/sign-incodeE29
/api/solana/rpccodeE30
/api/presale/claimcodeE31

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: WIZZARD · NFT Dungeon RPG
page title · https://wizzard.fun/
E2
Page description: Summon NFT heroes, send them into the dungeon and earn the game token. Own every hero in your wallet, fuse them, max their skills and climb the rankin
page description · https://wizzard.fun/
E3
53 request(s) to wizzard.fun
types: 43 image, 4 script, 2 fetch
GET https://wizzard.fun/ · image · 53 requests · network recording
E4
1 request(s) to fonts.googleapis.com
types: 1 stylesheet
GET https://fonts.googleapis.com/css2 · stylesheet · network recording
E5
1 request(s) to static.cloudflareinsights.com
types: 1 script
GET https://static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092 · script · network recording
E6
3 request(s) to fonts.gstatic.com
types: 3 font
GET https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 · font · 3 requests · network recording
E7
Cookie 'cf_clearance' set for wizzard.fun
kept for about 365 days
cookie cf_clearance on wizzard.fun · value not stored
E8
Cloudflare Turnstile found in the code
wizzard.fun/ (page HTML) @ 1958:24 · “challenges.cloudflare.com/turnstile” · pattern scan
E9
web3.js found in the code
wizzard.fun/ (page HTML) @ 3120:40 · “web3.js” · pattern scan
E10
Solana web3 / wallet adapter found in the code
wizzard.fun/ (page HTML) @ 3198:37 · “@solana/web3.js” · pattern scan
E11
Phantom found in the code
wizzard.fun/ (page HTML) @ 1849:11 · “window.phantom” · pattern scan
E12
Uses the browser ability: clipboard_write
can copy text to your clipboard
wizzard.fun/ (page HTML) @ 2717:42 · “clipboard.writeText(” · pattern scan
E13
Uses the browser ability: local_storage
saves small bits of data in your browser
wizzard.fun/ (page HTML) @ 1798:11 · “localStorage.setItem(” · pattern scan
E14
Uses the browser ability: canvas
draws graphics on a canvas
wizzard.fun/ (page HTML) @ 2898:18 · “getContext('2d'” · pattern scan
E15
The page called /api/health on wizzard.fun (GET)
GET https://wizzard.fun/api/health · fetch · network recording
E16
The page called /api/captcha on wizzard.fun (GET)
GET https://wizzard.fun/api/captcha · fetch · network recording
E17
Code reader found the endpoint /api/captcha
how: call:fetch
wizzard.fun/ @ 342:13 · “/api/captcha” · the code reader
E18
Code reader found the endpoint /api/account
how: call:fetch
wizzard.fun/ @ 513:11 · “/api/account” · the code reader
E19
Code reader found the endpoint /api/account/sign-out
how: call:fetch
wizzard.fun/ @ 527:11 · “/api/account/sign-out” · the code reader
E20
Code reader found the endpoint /api/referrals
how: call:fetch
wizzard.fun/ @ 695:4 · “/api/referrals” · the code reader
E21
Code reader found the endpoint /api/x/login
how: call:fetch
wizzard.fun/ @ 773:4 · “/api/x/login” · the code reader
E22
Code reader found the endpoint /api/discord/login
how: call:fetch
wizzard.fun/ @ 798:4 · “/api/discord/login” · the code reader
E23
Code reader found the endpoint /api/quest/claim
how: call:fetch
wizzard.fun/ @ 813:4 · “/api/quest/claim” · the code reader
E24
Code reader found the endpoint /api/profile/nickname-init
how: call:fetch
wizzard.fun/ @ 1072:4 · “/api/profile/nickname-init” · the code reader
E25
Code reader found the endpoint /api/health
how: call:fetch
wizzard.fun/ @ 1241:11 · “/api/health” · the code reader
E26
Code reader found the endpoint /api/i18n
how: call:fetch
wizzard.fun/i18n-auto.js @ 116:6 · “/api/i18n” · the code reader
E27
The code names the endpoint /api/wallet/challenge
wizzard.fun/ (page HTML) @ 1865:19 · “/api/wallet/challenge” · pattern scan
E28
The code names the endpoint /api/wallet/sign-in
wizzard.fun/ (page HTML) @ 1873:25 · “/api/wallet/sign-in” · pattern scan
E29
The code names the endpoint /api/evm/sign-in
wizzard.fun/ (page HTML) @ 1930:23 · “/api/evm/sign-in” · pattern scan
E30
The code names the endpoint /api/solana/rpc
wizzard.fun/ (page HTML) @ 3165:28 · “/api/solana/rpc” · pattern scan
E31
The code names the endpoint /api/presale/claim
wizzard.fun/ (page HTML) @ 3261:30 · “/api/presale/claim” · pattern scan
E32
3 links to pages on the same site
page links · https://wizzard.fun/ · /, /creators, /play
E33
Wallet request in code: eth_requestAccounts
asks to connect your wallet, which shows the site your address
wizzard.fun/ (page HTML) @ 1917:35 · “eth_requestAccounts” · pattern scan
E34
Wallet request in code: personal_sign
asks you to sign a text message (often to log in; moves no funds by itself)
wizzard.fun/ (page HTML) @ 1815:36 · “personal_sign” · pattern scan
E35
Wallet request in code: signTransaction
asks a wallet to sign transactions (often Solana wallets)
wizzard.fun/ (page HTML) @ 3117:45 · “signAndSendTransaction” · pattern scan
E36
The site says: “…Get started 🇬🇧 CREATORS PLAY NOW LIVE NOW · ON SOLANA CONNECT WALLET REFERRAL BUY TOKENsoon DISCORD PRE-REGISTRATION Secure…”
page text · https://wizzard.fun/ · …Get started 🇬🇧 CREATORS PLAY NOW LIVE NOW · ON SOLANA CONNECT WALLET REFERRAL BUY TOKENsoon DISCORD PRE-REGISTRATION Secure…
E37
The Internet Archive first saved wizzard.fun on 2026-10-27 and has snapshots from 1 different days
page web archive · https://web.archive.org/web/20261027192757/wizzard.fun
E38
Agent step 1: view
AI agent step 1 · view on /
E39
Agent step 2: click CONNECT WALLET
AI agent step 2 · click on / · page called GET wizzard.fun/api/captcha
E40
Agent step 3: go /play
AI agent step 3 · go on /play · page called POST wizzard.fun/cdn-cgi/challenge-platform/h/b/fo/548620793:1794244535:npZgr76Uq5OmM1r_ZX8WLcR4Q6hjXrbSU3V4yUd8G-c/a57ed590b93e176a/Yik, POST challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/fo/2224589282:1794244537:9R37ZBFqj8_mze1bfbwAtFg4pDafzyVrPVjS5bdpylo/a57ed592da631587/Cn, GET brunhi

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id KkmMlQ46.