backpack-exchang[.]live

This domain is classified as an elevated-risk brand impersonation threat, specifically targeting users through an airdrop scam. Analysis indicates the domain was designed to deceive victims by mimicking a legitimate cryptocurrency airdrop calculator, exploiting user interest in token distributions to harvest credentials or distribute malicious payloads. The page title, 'Backpack — Airdrop Calculator,' directly reinforces the fraudulent narrative, while the infrastructure leverages modern web technologies to enhance perceived legitimacy. Infrastructure analysis reveals the domain was registered on March 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 188.114.97.3. It appears on four security blocklists and is flagged by 5 out of 95 security vendors on VirusTotal. The domain has been assigned a trust score of 0/100 by Gridinsoft and is blocked by multiple security frameworks. Technologies detected include HSTS, Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3, suggesting an attempt to obfuscate malicious activity behind reputable hosting and encryption protocols. Mitigation against this threat requires immediate domain blacklisting in enterprise security policies, particularly for organizations handling cryptocurrency transactions. Users should be educated to verify airdrop legitimacy through official channels, avoiding unsolicited links or calculators. Network-level monitoring should prioritize connections to 188.114.97.3, while security teams should cross-reference the domain’s creation date and registrar details to identify related infrastructure. Given the domain’s current offline status, continuous monitoring for reactivation or rebranding is recommended, as threat actors frequently repurpose impersonation tactics under new domains.