crackaf-bubbles-frontend[.]vercel[.]app

This domain, crackaf-bubbles-frontend.vercel.app, is actively engaged in brand impersonation, specifically targeting PancakeSwap, a decentralized exchange platform. Analysis confirms its current status as active, with no indications of takedown or mitigation as of the latest intelligence. The domain mimics the legitimate PancakeSwap interface, as evidenced by the page title 'Exchange | PancakeSwap - ...', aiming to deceive users into disclosing sensitive credentials or interacting with malicious contracts. Infrastructure analysis reveals the domain is flagged by 16 of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. The domain was registered through Tucows Domains Inc. on February 21, 2026, an anomalous creation date suggesting potential typosquatting or preemptive registration for malicious use. It resolves to the IP address 64.29.17.131 and is associated with an SSL certificate issued by Google Trust Services (WR1). The domain appears on 2 security blocklists, further corroborating its high-risk classification. Notably, the use of Vercel's hosting infrastructure may provide the threat actor with agility in deploying and rotating malicious content. Current status remains active, posing an ongoing risk to users who may inadvertently interact with the domain. Organizations and individuals are advised to block the domain and its associated IP address (64.29.17.131) at the network perimeter. End-users should be alerted to verify domain authenticity before engaging with decentralized finance platforms, particularly those resembling PancakeSwap. Security teams are recommended to monitor for related indicators of compromise, including the SSL certificate thumbprint and any subdomains or redirects associated with this infrastructure. Proactive hunting for similar impersonation domains using the seed '7d1d2e' may uncover additional threats in this campaign.