pancakecwap[.]org

Analysis indicates that pancakecwap.org was registered on April 14 2025 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.97.3 located in the United States under ASN 13335. The domain is configured with Cloudflare’s DNS (bill.ns.cloudflare.com, roxy.ns.cloudflare.com) and serves HTTP/3, but attempts to establish an HTTPS session result in a 525 SSL handshake failure, confirming that no valid TLS certificate is presented to clients. The SSL certificate that does appear is issued by Google Trust Services under the WE1 root, which is unrelated to the domain’s intended brand and further evidences misconfiguration or intentional denial of secure access. Threat intelligence flags the site as a brand‑impersonation campaign targeting PancakeSwap.

AlienVault OTX records the domain in fifteen separate pulses, and multiple anti‑phishing blocklists—including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have listed it. In total the domain appears on five security blocklists. VirusTotal analysis shows thirteen of ninety‑five scanners flag the domain as malicious, reinforcing the suspicion of a crypto‑related scam. The associated phishing kit is identified as an “Airdrop Scam,” consistent with the broader classification of a crypto scam.

The observable evidence confirms that the domain was actively used for fraudulent activity and is presently taken offline. However, the underlying infrastructure (Cloudflare DNS and the 188.114.97.3 IP) remains under the control of the same hosting provider, allowing a potential re‑registration or reuse of the same IP range. Defenders should therefore add pancakecwap.org to URL filtering and endpoint blocklists, monitor the associated IP and nameserver pair for future activity, and advise users to verify any PancakeSwap‑related communications against official channels. Continuous intelligence feeds should be consulted for any resurgence of the domain or related indicators.