backpack[.]exchanges[.]digital

Analysis of the domain backpack.exchanges.digital indicates active brand impersonation targeting Backpack, a cryptocurrency exchange platform. The domain was registered on March 11, 2026, and is currently resolving to IP address 172.67.189.192, hosted on AS13335 (Cloudflare, Inc.) in the United States. The site returns an HTTP 502 status with the page title 'exchanges.digital | 502: Bad gateway,' suggesting either a misconfigured server or an attempt to evade immediate detection while maintaining infrastructure readiness for malicious use. The domain appears on one security blocklist (PhishDestroy) and is flagged by 1 of 94 security vendors on VirusTotal as malicious. Infrastructure analysis reveals the use of Cloudflare nameservers (maya.ns.cloudflare.com, amos.ns.cloudflare.com) and a Let's Encrypt SSL certificate (serial number E8), which are common among both legitimate and malicious sites. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with fraudulent domains. While the exact content of the site remains unconfirmed due to the 502 error, the scam type is classified as a fake exchange, aligning with the impersonation of Backpack. Defenders should treat this domain as high-risk and prioritize blocking or monitoring its resolution, particularly in environments where Backpack-related services are used. Given the domain's recent registration and active status, further malicious activity—such as phishing campaigns, credential harvesting, or fraudulent transaction pages—is likely imminent. Additional investigation into associated IP ranges and certificate reuse may uncover related infrastructure.