# PhishDestroy domain threat record: pancakeswap-pancake.webflow.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/pancakeswap-pancake.webflow.io/
Machine-readable companion: https://phishdestroy.io/domain/pancakeswap-pancake.webflow.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-12 04:40:09 UTC
- Last availability or vendor check: 2026-10-21 01:15:56 UTC
- Stored record updated: 2026-10-22 14:23:41 UTC
- VirusTotal detections in the stored snapshot: 4/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: PancakeSwap

## Stored infrastructure

- Observed IP address: 172.64.151.8
- Registrar in stored WHOIS data: Webflow
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 404
- Registration date (registry RDAP, webflow.io): 2013-05-08 02:20:57 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/pancakeswap-pancake.webflow.io
- Certificate Transparency search: https://crt.sh/?q=%25.pancakeswap-pancake.webflow.io
- Web Archive lookup: https://web.archive.org/web/*/https://pancakeswap-pancake.webflow.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
pancakeswap-pancake.webflow.io is an impersonation phishing page that borrowed the PancakeSwap name to lure traders of the decentralized exchange. It sat on a free Webflow subdomain, where anyone can publish a site in minutes under a name that looks official at a glance. PhishDestroy first saw it on 2026-09-12. The site has been dead since 2026-09-19 and was still offline at the last check on 2026-10-19, with nothing served at the root.

How the scam works
Fake PancakeSwap pages usually copy the exchange's swap interface and ask visitors to connect a wallet. They then push the victim to sign a token approval or transaction that hands their funds to the attacker, or to type a recovery phrase under the pretext of fixing a sync or connection error. Either way, the victim can lose the tokens in that wallet, and with a leaked seed phrase they lose the whole wallet. The page title now reads "404 - Page not found", while we classified the site as PancakeSwap impersonation phishing.

Evidence
On 2026-09-20 four of 89 VirusTotal engines flagged the address: alphaMountain.ai, Fortinet, PhishFort and VIPRE. That is a small share, but PhishFort focuses on crypto brand abuse, which makes its verdict relevant here. PhishDestroy lists the domain on its own blocklist. The low count means many browsers and security tools may never have warned visitors while the page was live.

Infrastructure
The operation used no domain of its own. It ran as a subdomain of Webflow's hosting platform, so the registrar is Webflow, and traffic was served through Cloudflare's network from an address geolocated to Canada. This kind of setup is cheap and disposable. A phisher can abandon the subdomain and stand up a new one with a fresh PancakeSwap-style name, which fits the roughly one week between our first sighting and the site going offline.

What to do
If you connected a wallet to this page, open a token-approval checker for the networks you use and revoke any approvals you don't recognize. Do this before moving any more funds. If you typed your recovery phrase, treat that wallet as compromised and move your assets to a new wallet with a newly generated seed. Reach PancakeSwap only through a bookmark you saved yourself, never through links in ads, DMs or search results. Defenders should block this subdomain and watch for new Webflow subdomains that combine "pancakeswap" with other words.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/pancakeswap-pancake.webflow.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pancakeswap-pancake.webflow.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:19:26 UTC

## Stored page captures

- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ed129016-b20e-4c2a-9ec1-840fae706e51.png
  Captured: 2026-09-20 17:45:12 UTC
  Source report: https://radar.cloudflare.com/scan/ed129016-b20e-4c2a-9ec1-840fae706e51
  SHA-256: a380e448eb3101674f4c67f891f37ba29b76e79d0bcca3163d4b1510d947431b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:34:15Z",
        "uuid": "ed129016-b20e-4c2a-9ec1-840fae706e51",
        "scanned_at": "2026-09-20T17:45:12Z",
        "final_url": "https://pancakeswap-pancake.webflow.io/",
        "status": 404,
        "history": [
            {
                "url": "https://pancakeswap-pancake.webflow.io/",
                "status": 404
            }
        ],
        "dom_hash": "4932075438459d054af6b75a0d6585b123ae775f36579c095159b2af33360488",
        "doc_hash": "90c032f35272ba1a7aa93027ab635e6610d4f24cf9e53c0624d00f065d7c7e7d",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "pancakeswap-pancake.webflow.io",
                "type": "A",
                "value": "104.18.36.248"
            },
            {
                "name": "pancakeswap-pancake.webflow.io",
                "type": "A",
                "value": "172.64.151.8"
            },
            {
                "name": "pancakeswap-pancake.webflow.io",
                "type": "AAAA",
                "value": "2a06:98c1:3105::6812:24f8"
            },
            {
                "name": "pancakeswap-pancake.webflow.io",
                "type": "AAAA",
                "value": "2a06:98c1:3102::ac40:9708"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.18.36.248",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-05-08T02:20:57Z",
            "updated": "2026-08-12T04:04:30Z",
            "expires": "2028-05-08T02:20:57Z",
            "nameservers": [
                "lamar.ns.cloudflare.com",
                "journey.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T06:15:29Z",
        "analysis_at": "2026-09-19T09:05:01Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 4,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "VIPRE": "malware",
            "Fortinet": "phishing",
            "PhishFort": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Hosting, Phishing (alphaMountain.ai)"
        },
        "registrar": "MarkMonitor Inc.",
        "created": "2013-05-08T02:20:57Z",
        "expires": "2028-05-08T02:20:57Z",
        "updated": "2026-08-12T04:04:30Z",
        "first_seen": "2026-09-11T20:17:23Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.64.151.8"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a06:98c1:3105::6812:24f8"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.18.36.248"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a06:98c1:3102::ac40:9708"
            }
        ],
        "dns_at": "2026-09-19T09:19:31Z",
        "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "webflow.io",
                "*.webflow.io"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "7e5a9322f440be460e62bc877c41833c",
            "sha256": "a4ffdefa8d99689893e2aafdf9588b6f8f2f8ec47698ea534dbfa409dbbde19d",
            "subject": "webflow.io",
            "valid_to": "2026-10-23T03:21:05Z",
            "valid_from": "2026-07-25T02:21:21Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-05-08T02:20:57Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2028-05-08T02:20:57Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "journey.ns.cloudflare.com",
                "lamar.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```