backpaxk[.]exchange

The domain backpaxk.exchange was registered on February 21, 2026 through NiceNIC International Group Co., Limited and currently resolves to the IP address 172.67.179.206, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are alexa.ns.cloudflare.com and nolan.ns.cloudflare.com, indicating that the infrastructure is hosted behind Cloudflare’s edge network. The site presented a page title of "Home - Backpack: Crypto Exchange & Wallet | Solana, Ethereum & BTC," explicitly referencing Solana and positioning itself as a cryptocurrency exchange and wallet service. This aligns with the reported brand target of Solana and the classification of the activity as a crypto scam.

Technical analysis shows the site employed React, enforced HTTP Strict Transport Security, and served content over HTTP/3, all typical of modern web applications. The SSL certificate was issued by Google Trust Services under the WE1 designation, providing a valid TLS handshake but offering no assurance of legitimacy. HTTP responses returned a 403 status, suggesting restricted access or intentional denial of service when queried. The domain appears on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting consensus among multiple threat intelligence feeds that the site is malicious.

VirusTotal scans recorded seven detections out of ninety‑three security vendors, further corroborating the malicious disposition. Although the site is currently taken offline, the combination of brand impersonation, cryptocurrency‑focused page title, and multiple independent blocklist entries indicates a high likelihood of phishing or credential‑harvesting activity targeting Solana users. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the host or related subdomains, and update endpoint protection signatures to include the observed IP and certificate fingerprint.