new-haspack-wallet[.]pages[.]dev

The domain new-haspack-wallet.pages.dev was registered on October 25, 2025 and is currently active. HTTP requests return a 200 status code and the site presents the page title "HashPack Wallet – The Secure Gateway to the Hedera Ecosystem," indicating an attempt to masquerade as the official HashPack wallet. Infrastructure analysis shows the domain resolves to IP 172.66.47.15, which belongs to AS13335 Cloudflare, Inc. in the United States. The SSL certificate is issued by Google Trust Services under the WE1 leaf, and the site enforces HSTS while supporting HTTP/3, confirming a modern Cloudflare deployment. Reputation data is poor: Gridinsoft assigns a trust score of 0/100, and nine of ninety‑three VirusTotal scanners flag the domain. Google Safe Browsing lists the site under the "SOCIAL_ENGINEERING" category, and it appears on a single blocklist (PhishDestroy). Nameservers are desiree.ns.cloudflare.com and syeef.ns.cloudflare.com. The threat is classified as a crypto drainer, targeting users of the HashPack wallet to illicitly capture cryptocurrency assets. Defenders should block the domain at DNS and proxy layers, add the IP address to threat‑intel feeds, and monitor for any related hash‑pack‑specific traffic patterns. Continuous re‑evaluation is advised, as further malicious payloads or credential‑stealing pages may be deployed behind the same infrastructure.