hashpackweb3-wallet[.]created[.]app

Analysis as of July 24, 2026 indicates that the domain hashpackweb3-wallet.created.app is actively hosting a crypto-drainer operation. The domain was registered through the Created App service, and its authoritative name server information is not publicly available (NS_NOT_FOUND). DNS resolution returns the IPv4 address 216.150.16.129, which is the sole hosting endpoint observed. The IP address has not been linked to known hosting providers or cloud services in the available data, and no additional infrastructure such as CDN or reverse-proxy layers have been identified. The domain appears on a single security blocklist and is currently listed as blocked by PhishDestroy, confirming that at least one reputable anti‑phishing feed has flagged the host.

No other public blocklists or reputation services are reported. A VirusTotal scan performed by 91 vendors returned no detections, but the absence of a match does not constitute a safety assurance and should be interpreted as a lack of current signatures rather than a clean bill of health. Because the page title, SSL certificate details, HTTP response codes, and any observed content are not provided, the exact phishing landing page cannot be described. Consequently, the specific tactics used to lure victims—whether through deceptive URLs, social engineering messages, or compromised accounts—remain uncertain. However, the classification as a crypto-drainer suggests that the site likely attempts to trick users into transferring cryptocurrency assets to addresses controlled by the threat actor.

Defenders should prioritize the following actions: add 216.150.16.129 to network-level deny lists and configure DNS filtering to block hashpackweb3-wallet.created.app. Monitor outbound traffic for attempts to contact the domain or resolve its IP, especially from endpoints that handle cryptocurrency wallets.