hashpck-en-us[.]pages[.]dev

This domain is classified as a high-risk phishing site targeting users of the Hedera ecosystem. Analysis indicates it impersonates the legitimate HashPack Wallet interface, presenting a fraudulent login portal to harvest cryptocurrency wallet credentials and private keys. The specific threat involves credential theft through social engineering, leveraging the cloned interface of a trusted cryptocurrency wallet service. Infrastructure analysis reveals the domain hashpck-en-us.pages.dev was registered on February 21, 2026, through Cloudflare, Inc. It resolves to IP address 172.66.44.251, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). Security telemetry shows the domain appears on 1 blocklist, with VirusTotal detecting malicious activity from 10 out of 95 security vendors. Google Safe Browsing also flags this domain as phishing. The page title, 'HashPack Wallet | Secure Gateway to the Hedera Ecosystem,' directly mimics the legitimate service to deceive users. Mitigation requires immediate blocking of the domain and its resolving IP (172.66.44.251) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, firewalls, and email gateways to prevent access. Users who may have interacted with the domain should revoke any active sessions, rotate credentials, and verify wallet integrity for potential unauthorized transactions. Cryptocurrency holders are advised to cross-check wallet addresses and enable multi-factor authentication (MFA) on all related accounts. Monitoring for secondary phishing attempts via email or social media is recommended, as attackers may reuse stolen credentials for follow-up attacks.