en-hashpack[.]app

Analysis of en-hashpack.app indicates that the site was used to present a counterfeit wallet interface for the Hedera HBAR ecosystem, as reflected in its page title “HashPack Wallet | Secure and Trusted HBAR Wallet for the Hedera Ecosystem”. The domain resolves to IP 104.21.11.144, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. DNS resolution is handled by sasha.ns.cloudflare.com and trace.ns.cloudflare.com, confirming Cloudflare as the registrar and hosting provider. No SSL certificate was observed, meaning the site operated without HTTPS encryption.

Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100. Google Safe Browsing classifies the domain as social engineering, and it appears on a single security blocklist. Independent threat‑intelligence feeds have recorded the domain in one AlienVault OTX pulse and PhishDestroy has listed it as blocked. VirusTotal scans show that eight out of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment.

The site is currently taken offline, but the historical indicators suggest a crypto‑scam campaign aimed at harvesting private keys or credentials from Hedera users. Defenders should continue to block traffic to the domain and its associated IP address, add the nameservers to DNS‑filtering policies, and monitor for any resurgence of the same infrastructure. Because the domain was hosted behind Cloudflare, future abuse may appear under different subdomains, so threat‑hunting rules should include the observed IP range and the specific page title string. Organizations handling HBAR assets should educate users about the risk of unsolicited wallet links and enforce multi‑factor authentication wherever possible.