# PhishDestroy threat dossier — pancakeswapd.github.io ================================================================ Fetched: 2026-04-22 02:41:13 UTC Canonical: https://phishdestroy.io/domain/pancakeswapd.github.io/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: PancakeSwap ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 19/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, OpenPhish, Seclookup, Sophos, VIPRE, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 185.199.108.153 (US, San Francisco) ASN: AS54113 Fastly, Inc. Hosting org: GitHub, Inc Registrar: GitHub, Inc. Nameservers: NS_NOT_FOUND Registered: 2026-04-19 Page title: PancakeSwap™ | Home Official Site HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-07-05 Status: INVALID chain Fingerprint: ea69bc711cb9d45698d2fdaa4854d7dc086acd3a9c350164909b688ac7c0631f Subject Alternative Names (related infrastructure — often same operator): - github.com - github.io - githubusercontent.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-19 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-19 03:16:14 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:04:57 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019da315-feda-72e6-84d8-97a3d3a503e5/ Wayback Machine: https://web.archive.org/web/*/pancakeswapd.github.io crt.sh CT logs: https://crt.sh/?q=%25.pancakeswapd.github.io Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=pancakeswapd.github.io AlienVault OTX: https://otx.alienvault.com/indicator/domain/pancakeswapd.github.io URLhaus: https://urlhaus.abuse.ch/host/pancakeswapd.github.io/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-19 03:17:54 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies pancakeswapd.github.io as an actively malicious domain engaging in brand impersonation targeting PancakeSwap users. This domain resolves to IP 185.199.108.153 and leverages GitHub’s infrastructure to deliver a counterfeit PancakeSwap interface designed to deceive users into connecting cryptocurrency wallets and authorizing unauthorized transactions. The threat is classified as elevated due to the combination of active distribution, cryptocurrency drainer functionality, and mimicry of a major decentralized finance platform. This is not merely a phishing site—it is a live crypto drainer campaign. This domain was flagged with 13 out of 95 security vendors on VirusTotal indicating compromise or malicious intent. It is registered via GitHub, Inc., leveraging a legitimate hosting provider to evade traditional detection. The associated IP address, 185.199.108.153, is part of GitHub’s Pages infrastructure and hosts a Let’s Encrypt SSL certificate to enhance credibility. The domain has no legitimate relation to PancakeSwap, which operates under the official domain pancakeswap.finance, and is currently unlisted on major blocklists such as Google Safe Browsing and OpenPhish as of the latest scan, suggesting rapid deployment and low prior exposure. The use of a GitHub Pages subdomain (pancakeswapd.github.io) further exploits trust in familiar platforms to obscure malicious intent. Immediate mitigation steps are required. Users must avoid accessing pancakeswapd.github.io or any similarly named GitHub subdomain purporting to offer PancakeSwap services. Always verify official URLs via official communication channels or the project’s verified social media and documentation. Before connecting a wallet or signing any transaction, confirm the domain is exact: pancakeswap.finance. Use browser extensions like WalletGuard or Revoke.cash to monitor and revoke unauthorized smart contract approvals. Enable hardware wallets for high-value assets and avoid clicking links from unsolicited messages or social media posts. Organizations should block this domain and IP at DNS and firewall levels and update threat intelligence feeds to include this indicator. Report this domain to PancakeSwap’s security team and relevant abuse channels to aid in takedown efforts. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 4b4c5aed1a632c59507afa5f4420430b TLS cert SHA-256: ea69bc711cb9d45698d2fdaa4854d7dc086acd3a9c350164909b688ac7c0631f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/pancakeswapd.github.io/ JSON API: https://api.destroy.tools/v1/check?domain=pancakeswapd.github.io Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io