Is packscan.cc a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

PackScan is a newly launched website presenting itself as an AI-driven crypto portfolio tracker. It invites visitors to connect a Solana or EVM wallet so it can scan token holdings, score risk, and surface supposed "profit opportunities" and "paperhanded" coins. Its apparent business model is a funnel in which a few free scans lead to implied paid trading insights, with pricing and monetization left undefined.

Scam/Impersonation Risk

The evidence converges on a clearly elevated risk. Two major security vendors currently flag the domain as malicious, and further engines rate it suspicious, which amounts to a confirmed blacklist presence on third-party threat listings. This is reinforced by page-level behavior. On load, the homepage plays a staged "Verified by X" sequence that claims a user's X account has been "verified and linked to BackPack". It also shows a Backpack badge with a large follower count, so the site borrows the identity of an established wallet brand. No genuine account linkage can occur, because the page contains no login or authorization form. Next to this sits a wallet approval prompt worded "Approve to scan any amount", an open-ended permission request that is inconsistent with the same page's assurances of "No wallet signature required" and "No funds access". The site also labels itself "Site is secure", "Official website" and "No threats detected". These are self-issued attestations with no independent backing, and they are contradicted by external detections. The performance and scale claims cannot be substantiated. They include "7.7x upside", "18.75 SOL" of "missed profit", "250K+ wallets analyzed", "$2.5B+ portfolio value" and "1000+ tokens tracked". A testimonials section titled "Real traders, real results" supplies no attributable users. The page also showcases memecoins (TROLL, PIPPIN, ALCH, VANK, WOLF, CHILL), which suits a lure built on missed-gains narratives. These traits match the pattern of wallet-draining and approval-phishing lures. Sandbox runs did not observe an actual drain or clipboard hijack, so this is a pattern-based assessment and not an observed theft. The decisive factor is that the combination of a fake verification flow, an unbounded approval request, and active threat listings points to deceptive intent. Evidence:

• Homepage: a fake "Verified by X" and Backpack account-linking sequence, with a "Verification complete" message and a Backpack follower badge, and no real authentication form present.
• Homepage: wallet prompt reading "Approve to scan any amount", alongside claims of "No wallet signature required" and "No funds access".
• Homepage: unverifiable statistics (7.7x upside, 18.75 SOL missed profit, 250K+ wallets, $2.5B+ portfolio value) and self-declared "Official website" and "Site is secure" badges.
• Domain provenance: registered 2026-09-28 (~0.06 years, about three weeks old), with 12,927 archive snapshots all within 2026 (first seen 2026-10-05, last seen 2026-10-16, 1 year tracked), so this volume of captures reflects a brand-new domain and not an established history.

Regulatory Verification Notes

The site discloses no legal entity, registered address, licensing authority, or registration number. It also gives no verifiable contact route and no published terms of service or privacy terms. It promotes crypto trading insights and wallet analysis, which are activities that ordinarily call for clear operator identification. Pricing for the paid tier after the free scans is likewise never stated. These omissions are content gaps on the site's own pages. They are treated here as verification deficiencies and not as proof of fraud, and the confirmed threat listings noted above are what drive the cautionary posture. No third-party broker or regulatory-database match was found for the brand. The operator's real-world identity could not be independently connected to the site. Evidence:

• Homepage: no company name, address, license, or legal terms are published, and the only visible social presences are generic links to Twitter, Discord and Telegram.
• Site hosting: served from AS174 (COGENT-174, Cogent Communications) on a single IPv4 address registered in the ARIN region, geolocated to Canada.
• Transport encryption: TLS certificate issued by YR2 with domain-validation (DV) only, valid to 2027-01-05, which confirms encryption but no organizational vetting.
• Registration: domain registered through Namecheap with a privacy service masking registrant details, which is an administrative detail in itself.

What to Verify Next

Any consideration of this service should begin outside the site itself. The claimed link between PackScan and Backpack should be checked by contacting Backpack through its own official channels, since the on-page "verified account" flow cannot be relied on. The operator's legal identity should be sought through business-registry and financial-regulator searches in the jurisdictions that matter to the user, and the official support channels should be confirmed independently. Anyone who has already connected a wallet should review and revoke token approvals using a trusted allowance-checking tool and treat that wallet's exposure as potentially compromised. Evidence:

• Homepage: the Backpack verification flow and the follower badge are the claims to be confirmed with the brand directly.
• Homepage: the wallet-connection step and the "any amount" approval wording are the actions to check for lingering permissions.
• Threat listings: the current malicious flags from external security vendors should be rechecked on public reputation databases before any engagement.

Summary Verdict

The overall posture is high risk. Active third-party threat detections, staged verification theater, and an open-ended wallet permission request outweigh the site's polished presentation and technically valid encryption. The domain is also brand new and has no verifiable operator behind it. Available evidence is consistent with a deceptive wallet-connection lure and not a legitimate analytics service.

Infrastructure Integrity

The site resolves to a single, directly exposed address, with no CDN or web-application firewall in front of it and no protective layer to mitigate that exposure. That address sits on shared provider infrastructure, and several abuse reports have been filed against it. Those reports concern the shared address and cannot be attributed to this site alone, and they were not discounted in the assessment. Heuristics also note a very young domain with a sparse subdomain footprint and fragmented infrastructure. These are unconfirmed indicators that add to the picture without being decisive.

Closing Assessment

The site should not be used for any wallet connection, approval signing, credential entry, or payment. Anyone who has already interacted with it should revoke wallet permissions and move assets to a fresh wallet. Browsing the page without interacting is the only low-risk use.

Signals weighed against the site

• AbuseIPDB: 6 reports on hosting IP 170.75.160.175 (Lunanode Hosting Inc., Fixed Line ISP), 2% confidence. The reports are attributed to shared infrastructure, not specifically to this website.