claim[.]backpackfinance[.]xyz

The domain claim.backpackfinance.xyz is currently flagged as a high‑risk crypto‑drainer infrastructure. VirusTotal analysis shows that 16 of 91 scanned security vendors have identified the domain as malicious, indicating a non‑trivial detection consensus across multiple AV engines. Independent blocklist services have also marked the domain, with PhishDestroy, MetaMask, and SEAL explicitly listing it as blocked. In addition, the domain appears on three external security blocklists, reinforcing its classification as an active threat vector.

The combined evidence suggests that the site is being used to lure cryptocurrency users into transferring assets to attacker‑controlled wallets, a pattern consistent with known crypto‑drainer campaigns. While the exact phishing page content, hosting IP, SSL certificate details, and registrar information have not been disclosed, the presence on multiple reputable blocklists and the multi‑vendor detection count provide sufficient confidence for defensive action. Defenders should immediately add claim.backpackfinance.xyz to local deny‑list rules, enforce network‑level DNS filtering, and block any outbound connections to the domain at perimeter firewalls.

Endpoint protection policies should be updated to treat the domain as malicious, and any observed attempts to resolve or contact the domain should be logged and investigated. Users of cryptocurrency wallets, especially those employing MetaMask, should be warned that interactions with this domain may result in unauthorized fund transfers. Continuous monitoring for new indicators, such as IP address changes or associated subdomains, is recommended to maintain situational awareness as the threat actor may evolve its infrastructure.