Is packscan.co a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

The website presents itself as "PackScan", an AI-driven crypto portfolio tracker. It is a single landing page with a text-based product pitch and no further pages. Its apparent purpose is to attract crypto holders to a portfolio-analytics service, which would typically involve linking wallets, exchange accounts or credentials.

Scam/Impersonation Risk

This is the dominant concern. Multiple independent threat-intelligence detections currently flag the domain, including detections from two major security vendors. The combined weight amounts to a confirmed blacklisting. The domain is also only weeks old, and a crypto-adjacent service on a freshly registered domain is the classic profile of short-lived fraud infrastructure. That profile matters more because the service category invites users to connect wallets or share portfolio access. No conflicting legal identities and no explicit brand impersonation were observed. The site also showed none of the on-page attack behaviours that sometimes accompany such listings. It showed no wallet-drainer routines, clipboard manipulation, hidden or externally posting credential forms, or content cloaking. Its outbound traffic stayed within expected third-party services. These observations lower the likelihood of an active on-page exploit during the observed sessions. They do not offset the external detections. Six abuse reports also exist against the hosting address, but they attach to a shared provider address and are a weaker, contextual signal. Evidence:

• Homepage hosting domain: registered 2026-09-28 via Namecheap (~23 days old, 0.06 years); the very young age is a material risk amplifier for a financial-adjacent service.
• Domain reputation: 3 malicious and 3 suspicious verdicts from the multi-engine scan, including two top-tier security vendors, plus an external blacklist hit.
• Hosting address 170.75.160.175: 6 abuse reports from one distinct reporter, attributed to shared provider infrastructure (Lunanode), with a low abuse-confidence rating.
• Homepage behavioural sessions (3 of 3 completed): no wallet-connect activity, no clipboard writes, no hidden forms, no cloaking, and no non-whitelisted external requests.

Regulatory Verification Notes

The site's real-world operator has not been independently connected to any named company or individual, and no regulatory standing could be established from the available evidence. The homepage presents an investment-adjacent crypto analytics proposition, and sites of this kind often fall under financial-services or virtual-asset oversight depending on the jurisdiction. No third-party broker or regulatory-database entry corresponds to this domain. The absence of such an entry is not a finding by itself. It means there is no independent reputational or licensing context to counterbalance the detections described above. Evidence:

• Homepage: the page title describes an "AI Crypto Portfolio Tracker", a service category that may carry licensing or registration obligations.
• No matching entry in the broker-reputation dataset, so no third-party regulatory context is available.
• Transport encryption: a basic domain-validated TLS certificate issued by YR1, valid to 2026-12-27. It proves only that the connection is encrypted, not who operates the site.

What to Verify Next

Any use beyond passive reading should first rest on independent confirmation of who operates the service. Confirm the operating legal entity and any financial or virtual-asset registration directly with the relevant national registry, using contact details obtained from that registry and not from the site. Check whether the product name and domain are referenced by credible independent sources, such as established crypto-industry directories or reputable community discussion. Confirm the official support and contact channels through an independent, offline route. Re-check the domain's threat-intelligence status before any interaction, since listings can be cleared or escalated. Evidence:

• Domain registered 2026-09-28; any claim of an established track record on the site should be checked against this date.
• Current external detections on the domain should be re-queried at the time of any planned interaction.
• The homepage is the only observed page, so there is no on-site legal or about page to cross-check against a registry.

Summary Verdict

The assessment is critical and clearly cautionary. Confirmed external threat detections, combined with the domain's extreme youth and its financially sensitive service category, outweigh the technically sound but unremarkable elements, such as a valid certificate and benign observed page behaviour. The site should be treated as high-risk for any sensitive interaction. Its real-world operator remains unverified.

Infrastructure Integrity

The site resolves to a single IP address served over Cogent Communications' network (AS174, also associated with AS394745 and the LN01 hosting label), registered with ARIN and located in Canada. No CDN or WAF edge layer was detected, so the hosting address is directly exposed, and protective infrastructure offers no mitigation here. The unconfirmed infrastructure heuristics (fragmentation, a sparse footprint typical of young domains, and few subdomains) are consistent with a recently stood-up deployment. They do not change the verdict.

Closing Assessment

Interaction should be limited to passive, read-only viewing. No account login, credential entry, wallet connection, API-key sharing or financial transaction should take place on this site while the external detections remain in force.

Signals weighed against the site

• AbuseIPDB: 6 reports on hosting IP 170.75.160.175 (Lunanode Hosting Inc., Fixed Line ISP), 2% confidence. The reports are attributed to shared infrastructure, not specifically to this website.