Website blueprint · 16 Oct 2026

vaultquest.fun

“Vault Quest — powered by Collector Crypt”

Template-written 15 evidence items REA analysed 17 scripts

What this means for you

vaultquest.fun talked to 1 outside service on a first visit, including 1 that measures visits or shows ads.E4

Before you click anything, the page loads analytics or ad services: Cloudflare Web Analytics.E4

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

The page doesn't make tech claims we check for (AI, on-chain, wallets, trading, own chain, staking, live data, an app).

Calls its own backend /api/prizesE9

Wallet code PhantomE6

Contract calls in its code none seen

Talks to AI services none seen

Live connections none seen

What it is

The site describes itself as: “A retro monster-catching RPG. Beat the Keeper of the Crypt and claim a real graded card.”E2
In your browser it saves small bits of data in your browser.E7
While loading, it called 1 endpoint on its own servers, such as /api/prizes.E9

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 1

static.cloudflareinsights.com

Cloudflare Web Analytics: page-view counter

1×E4

Crypto and wallets

Wallet tools in the code: Phantom.E6

How key features work

Connecting your wallet

It connects to crypto wallets using Phantom. Connecting shows the site your wallet address; it doesn't move funds by itself.E6

Phantom

Sign-in and accounts

Sign-in and account features show up in its code or traffic (/api/session).E13

/api/session

Loading its content

Its content loads from its own API while you browse (/api/prizes).E9

/api/prizes

Drawing and editing in the browser

The page draws and edits graphics in your browser using the canvas.E8

canvas

Measuring what you do

Visits and clicks are measured with Cloudflare Web Analytics (found in its traffic or its code).E4

Cloudflare Web Analytics

Saving data on your device

It saves data in your browser (localStorage), so some things persist between visits.E7 E5

local_storagelocalStorage

Cookies and storage

Names only. We never store the values.

localStorageE5: vq_keys

Pages and API calls

Endpoints

Called while loading (seen) or named in the code (code).

vaultquest.fun/api/prizes	seenE9
/api/prizes	codeE10
/api/open	codeE11
/api/wallet	codeE12
/api/session	codeE13
/api/progress	codeE14
/api/claim	codeE15

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

Page title: Vault Quest — powered by Collector Crypt

page title · https://vaultquest.fun/

Page description: A retro monster-catching RPG. Beat the Keeper of the Crypt and claim a real graded card.

page description · https://vaultquest.fun/

20 request(s) to vaultquest.fun

types: 16 script, 1 document, 1 stylesheet

GET https://vaultquest.fun/ · script · 20 requests · network recording

1 request(s) to static.cloudflareinsights.com

types: 1 script

GET https://static.cloudflareinsights.com/beacon.min.js/v4bc70e2c01a94c73b74392e4234840661791215815920 · script · network recording

localStorage: 1 key(s) saved in your browser

localStorage keys: vq_keys · values not stored

Phantom found in the code

vaultquest.fun/ (page HTML) @ 36:134 · “phantom.app” · pattern scan

Uses the browser ability: local_storage

saves small bits of data in your browser

vaultquest.fun/js/guide.js @ 171:81 · “localStorage.setItem(” · pattern scan

Uses the browser ability: canvas

draws graphics on a canvas

vaultquest.fun/js/gfx.js @ 114:19 · “getContext('2d'” · pattern scan

The page called /api/prizes on vaultquest.fun (GET)

GET https://vaultquest.fun/api/prizes · fetch · network recording

E10

REA found the endpoint /api/prizes

how: call:fetch

vaultquest.fun/js/game.js @ 105:45 · “/api/prizes” · REA analyze-web-bundle 6.4.0

E11

REA found the endpoint /api/open

how: call:fetch

vaultquest.fun/js/prize.js @ 101:20 · “/api/open” · REA analyze-web-bundle 6.4.0

E12

REA found the endpoint /api/wallet

how: call:fetch

vaultquest.fun/js/prize.js @ 123:22 · “/api/wallet” · REA analyze-web-bundle 6.4.0

E13

REA found the endpoint /api/session

how: call:fetch

vaultquest.fun/js/pack.js @ 11:20 · “/api/session” · REA analyze-web-bundle 6.4.0

E14

REA found the endpoint /api/progress

how: call:fetch

vaultquest.fun/js/pack.js @ 30:22 · “/api/progress” · REA analyze-web-bundle 6.4.0

E15

The code names the endpoint /api/claim

vaultquest.fun/js/prize.js @ 139:30 · “/api/claim” · pattern scan

Limits

We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
Some trackers only load after you accept cookies or log in, so the real list can be longer.
We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
REA hit its size budget on parts of 8 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id TC5LuUyi.