# PhishDestroy domain threat record: pancakeswap-finance.typedream.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/pancakeswap-finance.typedream.app/ Machine-readable companion: https://phishdestroy.io/domain/pancakeswap-finance.typedream.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-14 16:40:09 UTC - Last availability or vendor check: 2026-10-22 10:06:28 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 2/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: PancakeSwap ## Stored infrastructure - Observed IP address: 188.114.97.9 - Registrar in stored WHOIS data: Squarespace Domains II LLC - Last stored HTTP status: 301 - Registration date (registry RDAP, typedream.app): 2021-01-22 08:47:25 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/pancakeswap-finance.typedream.app - Certificate Transparency search: https://crt.sh/?q=%25.pancakeswap-finance.typedream.app - Web Archive lookup: https://web.archive.org/web/*/https://pancakeswap-finance.typedream.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview pancakeswap-finance.typedream.app is an impersonation phishing page that borrows the PancakeSwap name to catch traders looking for the decentralized exchange. It sits on a subdomain of typedream.app, a hosted site-builder platform, so the brand-like part of the address belongs to the scammer and not to PancakeSwap. PhishDestroy first saw it on 2026-09-14. On 2026-10-19 the site was still alive and its content responded with a redirect. How the scam works PancakeSwap clones usually copy the swap interface and ask visitors to connect a wallet. They then push a transaction to sign, a token approval, or a "wallet sync" form that asks for the recovery phrase. A signed approval lets the operator move the approved tokens. A typed recovery phrase gives them the whole wallet. The page currently shows the title "404: This page could not be found.", which differs from the impersonation content behind our classification. Evidence Spamhaus lists the hostname in its DBL as DBL_ABUSED_PHISH, a category for phishing hosted on an otherwise legitimate domain. That fits a scam page built on a shared site-builder. On 2026-09-23, VirusTotal showed only 2 of 89 engines flagging it, alphaMountain.ai and Fortinet. Most security tools will therefore let it load without a warning. PhishDestroy lists it on its blocklist as PancakeSwap impersonation. Infrastructure The operator needed no domain registration of their own. They published the page on a free-to-start builder subdomain, which costs nothing and can be swapped quickly if taken down. Traffic is served through Cloudflare, Inc., with the address geolocated to CA. That only shows the page sits behind a large shared edge network, not where the operator is. What to do If you connected a wallet here and approved or signed anything, use a token-approval checker to revoke every allowance you granted. Then move remaining funds to a fresh wallet. If you entered your recovery phrase, treat the wallet as compromised and transfer assets to a new seed immediately, since revoking approvals will not help. Reach PancakeSwap only by typing its official address or using a saved bookmark, never through search ads or shared links. Defenders should block the full hostname rather than all of typedream.app and report the page to the hosting platform's abuse team. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/pancakeswap-finance.typedream.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pancakeswap-finance.typedream.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:42:51 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/14aa5fb6-f7c6-4bdc-923c-94b494c8694a.png Captured: 2026-09-21 12:49:59 UTC Source report: https://radar.cloudflare.com/scan/14aa5fb6-f7c6-4bdc-923c-94b494c8694a SHA-256: 5078c7ade226767267e6e1cf945c1ad577c4d808f773fca6bb35d22da8f6cc54 - URLScan ยท 2026-09-13: https://screenshots.phishdestroy.io/us/01a09a46-b1b6-73fc-a371-53439582459b.png Captured: 2026-09-13 10:18:47 UTC Source report: https://urlscan.io/result/01a09a46-b1b6-73fc-a371-53439582459b/ SHA-256: 08fa1fdc50defc02c8db463a0e0404c917b8607444e2ed35a0c8cd1dcbb1271d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:34Z", "uuid": "14aa5fb6-f7c6-4bdc-923c-94b494c8694a", "scanned_at": "2026-09-21T12:49:59Z", "final_url": "https://pancakeswap-finance.typedream.app/", "status": 404, "history": [ { "url": "https://pancakeswap-finance.typedream.app/", "status": 404 } ], "dom_hash": "ec5144797bcc663b267a71f6936fa92797e7b56be7df8d6bc615e33860eb4218", "doc_hash": "a04f87ade9d44b1267bc0a6f542d40c6f5b4563117f215a9413d497d63e89445", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "pancakeswap-finance.typedream.app", "type": "A", "value": "172.67.206.36" }, { "name": "pancakeswap-finance.typedream.app", "type": "A", "value": "104.21.37.85" } ], "dnssec_valid": false, "ip": "172.67.206.36", "whois": { "registrar": "Squarespace Domains II LLC.", "created": "2021-01-22T08:47:25Z", "updated": "2026-01-12T09:38:06Z", "expires": "2027-01-22T08:47:25Z", "nameservers": [ "annalise.ns.cloudflare.com", "darwin.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T01:53:05Z", "analysis_at": "2026-09-21T09:03:14Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 2, "suspicious": 0, "undetected": 36 }, "detections": { "Fortinet": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "Squarespace Domains II LLC", "created": "2021-01-22T08:47:25Z", "expires": "2026-01-22T08:47:25Z", "updated": "2025-01-12T12:14:22Z", "first_seen": "2026-09-13T11:09:35Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.37.85" }, { "ttl": 300, "type": "A", "value": "172.67.206.36" } ], "dns_at": "2026-09-21T09:11:02Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "typedream.app", "*.typedream.app" ], "issuer": "Google Trust Services / WE1", "serial": "5a899b9bc415bdde0e77afdb42fa0866", "sha256": "ab441e0ffa6b15dd7c83fe1fe0e35948cc4fafcbe4787eb2ec7c78bb57a9a4d6", "subject": "typedream.app", "valid_to": "2026-10-24T11:06:11Z", "valid_from": "2026-07-26T10:07:26Z" }, "whois": { "registrar": "Squarespace Domains II LLC", "registrar_iana_id": "895", "registrar_url": "domains.squarespace.com", "created": "2021-01-22T08:47:25Z", "updated": "2025-01-07T12:14:23Z", "expires": "2026-01-22T08:47:25Z", "status": [ "client", "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "annalise.ns.cloudflare.com", "darwin.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```