backpackapp[.]online

PhishDestroy identifies backpackapp.online as a brand impersonation site that tricks users into surrendering wallet credentials or seed phrases. The page masquerades as a legitimate crypto-service called Backpack to harvest private keys, which attackers then use to drain wallets instantly. Any data entered—usernames, passwords, recovery phrases, or connected wallet signatures—is sent directly to a remote server controlled by the scammers. Never type any login details or authorize wallet connections on this domain.

This domain was flagged after VirusTotal analysis returned zero out of ninety-five antivirus engines detecting it at the time of inspection. Public records show the domain was created on September 19, 2025, making it just days old, and it is registered through Tucows.com, CO, a registrar often abused for short-lived malicious domains. The site currently resolves to IP address 35.157.26.135 while displaying a Let’s Encrypt SSL certificate, a common tactic to appear legitimate to casual visitors.

If you visited backpackapp.online, assume any credentials or wallet connections entered were compromised. Revoke all connected wallet permissions immediately using your wallet’s security settings, transfer remaining funds to a new wallet, and enable two-factor authentication. Scan your device with up-to-date antivirus software and consider changing passwords used anywhere online. Report the incident to the real brand’s support channel and warn others to avoid this domain entirely.