Is packscan.dev safe?
http://packscan.dev/
Coveragecomplete4 of 4 applicable core capabilities
PackScan is an 8-day-old phishing page that fakes X verification and Backpack wallet connection to push a wallet-drain approval.
PackScan presents itself scanning tool for crypto wallets, but the page is built to look like an official X verification and Backpack wallet integration. It shows 'Verified by X', 'BackPack Connected securely' and 'Verification complete Your X account has been verified and linked to BackPack', then asks the visitor to 'Approve to scan any amount' with a 'Network Fee ~0.002 SOL'. The domain is only 8 days old, no contact email is published, and two independent antivirus families flag it as phishing. The combination of a brand-new domain, impersonated verification, and a transaction-approval prompt is the classic crypto-drainer flow, so the score is 12 (Dangerous).
Be the first to review packscan.dev
Lost money to packscan.dev? Warn others
Loading saved screenshot
Preparing the saved page preview.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
01 · Investigation Brief
Investigation Brief
PackScan presents itself scanning tool for crypto wallets, but the page is built to look like an official X verification and Backpack wallet integration. It shows 'Verified by X', 'BackPack Connected securely' and 'Verification complete Your X account has been verified and linked to BackPack', then asks the visitor to 'Approve to scan any amount' with a 'Network Fee ~0.002 SOL'. The domain is only 8 days old, no contact email is published, and two independent antivirus families flag it as phishing. The combination of a brand-new domain, impersonated verification, and a transaction-approval prompt is the classic crypto-drainer flow, so the score is 12 (Dangerous).
Fake X verification and a wallet approval prompt
The page opens with trust signals that do not belong to it: 'Verified by X' and 'BackPack Connected securely'. It then claims 'Verification complete Your X account has been verified and linked to BackPack.' These lines mimic an official X verification and a Backpack wallet integration, but the domain is packscan.dev, not x.com or backpack.exchange.
After the fake verification, the site asks the visitor to 'Approve to scan any amount' and shows a 'Network Fee ~0.002 SOL'. A real scanner does not need a token approval to read a wallet. An approval prompt is the mechanism a drainer uses to move assets out of a connected wallet.
Technical flags and an undisclosed operator
Two independent antivirus families, Forcepoint ThreatSeeker and Kaspersky, report an adverse result on this domain, and the aggregate shows 2 malicious detections across 93 engines. That is a direct phishing flag, not a heuristic guess.
The registrable domain is only 8 days old, and the captured page contains no direct contact email. A brand-new domain with no contact route is consistent with a short-lived phishing deployment rather than an established service.
A valid TLS certificate and a clean the browser threat feed result were also recorded. Those only mean the connection is encrypted and no warning was served at scan time; they do not make the approval prompt or the impersonated verification safe.
Why the score is 12
2 independent antivirus families reported an adverse result. Coverage remains separate so missing sources cannot be mistaken for clean results.
02 · Security Evidence
Security evidence
Antivirus Engines
2/ 93
detectionsFresh result
2 engines flagged this URL
Every saved adverse engine is listed below. The full provider matrix remains available for audit.
- Malicious
- 2
- Suspicious
- 0
- Total
- 93
| Engine | Finding |
|---|---|
| Forcepoint ThreatSeekerMalicious | phishing |
| KasperskyMalicious | phishing |
All 93 engine results
- Forcepoint ThreatSeeker - phishing - Malicious
- Kaspersky - phishing - Malicious
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- AutoShun - Unrated
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- ChainPatrol - Unrated
- Chong Lua Dao - Clean
- CINS Army - Clean
- CRDF - Clean
- Criminal IP - Unrated
- CSIS Security Group - Unrated
- CTX AI - Clean
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Unrated
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- GreyNoise - Unrated
- Gridinsoft - Unrated
- Guardpot - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- K7AntiVirus - Unrated
- LevelBlue - Clean
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- Orcapot - Unrated
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- Snort IP sample list - Unrated
- SOCRadar - Clean
- Sophos - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- Synthient - Unrated
- ThreatHive - Clean
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Loading saved screenshot
Preparing the saved page preview.
Visual warning signs were identified
Verified by X Approve to scan any amount
What the captured page showed
2 observations- 01
Verified by X
- 02
Approve to scan any amount
03 · Investigation Story
Investigation story
What the site claims
PackScan — AI Crypto Portfolio Tracker
What we observed
The page content was captured and checked alongside 59 antivirus results.
What independent research found
The search completed without a material external warning or corroborating report.
What remains unverified
The checks completed, but ownership, business claims, and future site behavior can still change after this snapshot.
What kind of site and risk is this?
Threat category
Investment, Crypto & Wallet Fraud
Service and business model
Web3
Observed behavior
Evidence behind this classification
- 01Two independent antivirus families, Forcepoint ThreatSeeker and Kaspersky, report an adverse result, with 2 malicious detections across 93 engines.
- 022 independent antivirus families reported an adverse result.
- 03The registrable domain is 8 days old and the captured page contains no direct contact email.
What this means for you
What happens if a visitor follows the flow
A visitor who connects a wallet and clicks the approval is granting a transaction approval to the site under the label 'Approve to scan any amount'. The page frames this as a scan, but the action is an on-chain approval, which is the step that can move assets from the connected wallet.
How the observed mechanism works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
The page also displays a 'Network Fee ~0.002 SOL', which makes the approval look like a routine small cost. The fee display does not change the fact that the visitor is signing an approval requested by an unverified, 8-day-old domain.
Do not connect a wallet to packscan.dev and do not approve any transaction it requests. If you already approved, revoke the approval through your wallet's approval manager and move remaining assets to a fresh wallet. Treat the 'Verified by X' and 'BackPack Connected' messages as impersonation, not verification.
Web research findings
Independent findings for packscan.dev, including public complaints, named review sources, registration records, and look-alike-domain evidence. A missing result is shown as unverified, never converted into a clean bill of health.
No independently sourced scam reports or credibility records were found for packscan.dev. That is common for new or low-traffic sites and does not clear the site.
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too. Use this to corroborate the verdict, not to overturn it.
Infrastructure map
How the saved page connected to the wider web.
- Domainpackscan.dev
- Redirects topackscan.dev
- Hosted byLunanode Hosting Inc.
- Referencespackscan.co · fonts.googleapis.com
Domain Timeline
- Oct 15, 2026Domain registered
First appeared in WHOIS records — 8 days old when this review was saved.
- Oct 23, 2026Saved security review — Rated Dangerous
The completed checks from this saved scan are detailed above.
packscan.dev was registered very recently when this review was saved and was already flagged. Freshly-registered domains are disproportionately used for scams, and a young domain with active threat signals warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
- No direct contact email found on the captured page.
Domain & Encryption
Redirect Chain
- 1301http://packscan.dev/
- 2206https://packscan.dev/
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruscomplete
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
maliciousMalware, phishing, credential theft and hostile infrastructure.
2 independent antivirus families reported an adverse result.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
The page displays 'Verified by X' and 'BackPack Connected securely', and claims 'Verification complete Your X account has been verified and linked to BackPack', mimicking X and Backpack branding on a non-official domain. · The registrable domain is 8 days old and the captured page contains no direct contact email.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 2 of 93 engines flagged | Completed | Adverse | fresh · analysed Oct 23, 2026 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Oct 23, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Oct 23, 2026 |
| Visual evidence | 2 visible observations saved with the page capture | Completed | Adverse | this scan · Oct 23, 2026 |
| Independent research | The search completed without a material external finding | Completed | No adverse finding | this scan · Oct 23, 2026 |
- Antivirus
- Result2 of 93 engines flagged
- CompletionCompleted
- FindingAdverse
- Freshnessfresh · analysed Oct 23, 2026
- Browser protection
- ResultNo browser threat-list match
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 23, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 23, 2026
- Visual evidence
- Result2 visible observations saved with the page capture
- CompletionCompleted
- FindingAdverse
- Freshnessthis scan · Oct 23, 2026
- Independent research
- ResultThe search completed without a material external finding
- CompletionCompleted
- FindingNo adverse finding
- Freshnessthis scan · Oct 23, 2026
07 · Safety FAQ
Safety FAQ
Common questions, answered directly from the scan data above — so the answers reflect the saved verdict and evidence in this report.
Is packscan.dev a scam or a legit crypto platform?
Is packscan.dev safe to use?
I already deposited money on packscan.dev — what should I do?
Can I get my money back from packscan.dev?
Is packscan.dev a Ponzi scheme or a real crypto investment?
How do I report packscan.dev?
packscan.dev looks professional — how can it still be a scam?
Has packscan.dev been flagged by antivirus engines?
Is packscan.dev on any phishing or malware blacklists?
How old is the packscan.dev domain?
Where is packscan.dev hosted?
How often is the packscan.dev report updated?
08 · Final Verdict
Final verdict
PackScan is an 8-day-old phishing page that fakes X verification and Backpack wallet connection to push a wallet-drain approval.
PackScan presents itself scanning tool for crypto wallets, but the page is built to look like an official X verification and Backpack wallet integration. It shows 'Verified by X', 'BackPack Connected securely' and 'Verification complete Your X account has been verified and linked to BackPack', then asks the visitor to 'Approve to scan any amount' with a 'Network Fee ~0.002 SOL'. The domain is only 8 days old, no contact email is published, and two independent antivirus families flag it as phishing. The combination of a brand-new domain, impersonated verification, and a transaction-approval prompt is the classic crypto-drainer flow, so the score is 12 (Dangerous).
09 · Community