memberportal-backpack[.]com

On 25 July 2026 the domain memberportal-backpack.com was observed as an active brand‑impersonation campaign targeting the Backpack brand. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is served by the Cloudflare nameservers mary.ns.cloudflare.com and pedro.ns.cloudflare.com. DNS resolution directs the hostname to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. No TLS certificate is present, indicating the site was served over plain HTTP at the time of analysis. The HTTP response contained the page title “Nur einen Moment…”, but no further content has been publicly disclosed.

Threat intelligence platforms report that 13 of 93 antivirus engines on VirusTotal flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred. The domain appears on three independent blocklists and has been reported to and blocked by the PhishDestroy, MetaMask, and SEAL mitigation services. The campaign’s risk level is classified as high, and the operational status is currently offline. Analysis confirms that the infrastructure relies on a reputable CDN provider, which can obscure the true origin of the malicious payload, but the use of a generic Cloudflare‑hosted IP does not mitigate the identified threat.

The absence of an SSL certificate may be intentional to avoid certificate‑pinning checks, yet it also provides a straightforward indicator for detection. While the page title offers a limited clue, the lack of additional page content prevents a deeper assessment of the phishing vector. Defenders should continue to block the domain and its resolved IP at network perimeters, monitor for any resurgence of the hostname, and incorporate the observed indicators—such as the domain name, registrar, nameservers, IP address, and blocklist entries—into threat‑intelligence feeds.