hashpackwallet-es[.]created[.]app

The domain hashpackwallet-es.created.app was observed in active status on 24 July 2026. Infrastructure analysis shows the name resolves to the IP address 216.150.1.1, which is currently associated with a single security blocklist entry and is actively blocked by the PhishDestroy feed. Registration details indicate the domain was created through the service “Created App”, and the nameserver query returned no records, suggesting the registrar may be using default or concealed name servers.

The domain has been submitted to VirusTotal, where 91 antivirus and URL‑reputation engines have inspected the host; none have raised a detection, but the absence of a flag does not constitute a safety guarantee. The only confirmed indicator of malicious activity is the classification “crypto drainer”, implying the site is being used to solicit cryptocurrency deposits and subsequently exfiltrate funds. No additional telemetry such as page title, SSL certificate data, HTTP response codes, or content hashes is available at this time, leaving the exact phishing payload and victim interaction unknown.

Defenders should treat the domain as hostile, enforce network‑level blocks on the resolved IP, add the fully qualified domain name to local deny lists, and monitor for any DNS queries or outbound connections to the host. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in the threat profile, and any sightings of similar sub‑domains under the “created.app” namespace should be flagged for investigation. Organizations handling cryptocurrency assets should reinforce transaction verification procedures and educate users about unsolicited wallet requests that reference “hashpackwallet‑es”.