token-backpack[.]live

This domain, token-backpack.live, is identified as a high-risk brand impersonation site specifically targeting Backpack, a cryptocurrency wallet platform. Analysis indicates the infrastructure was designed to deceive users into believing they are interacting with official Backpack services, likely to execute unauthorized transactions or steal sensitive wallet credentials. No evidence of a drainer kit was observed in initial scans, though the domain's structure and naming convention strongly suggest intent to facilitate crypto asset theft. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.140.24, hosted on Cloudflare infrastructure (AS13335) in the United States. It was registered on January 01, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data. VirusTotal reports 14 out of 95 security vendors flagging this domain as malicious. The domain appears on three security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. No entries were found in Google Safe Browsing at the time of analysis, though this may reflect detection latency rather than benign status. As of the latest assessment, token-backpack.live has been taken offline, likely due to enforcement actions by hosting providers or registrars following abuse reports. However, the residual risk remains elevated due to the domain's recent creation date and the persistence of similar impersonation campaigns. Users who accessed this domain prior to its takedown should immediately revoke any connected wallet authorizations, rotate credentials, and monitor transaction histories for unauthorized activity. Organizations are advised to preemptively block this domain and its associated IP address in network security controls to prevent potential re-emergence or lateral movement within compromised environments.