pancake[.]fft5[.]xyz

Analysis of pancake.fft5.xyz shows that the domain was registered on 21 February 2026 and is currently taken offline. The domain resolves to 104.21.51.188, an IP address owned by Cloudflare, Inc. (ASN 13335) and geolocated in the United States. The TLS certificate presented is labeled WE1, indicating a possibly self‑signed or low‑trust certificate. VirusTotal has recorded detections from 13 of 95 scanning engines, indicating that multiple security products flag the site as malicious.

The domain appears on two public blocklists, PhishDestroy and ScamSniffer, both of which categorize it as a crypto‑related scam. Intelligence indicates that the site impersonates PancakeSwap, a well‑known decentralized exchange, and is classified as a crypto scam. No additional content analysis such as page title or HTTP response codes is available because the site is offline. The combination of brand impersonation, the presence on dedicated scam blocklists, and multiple vendor detections suggests a high probability of malicious intent aimed at deceiving users of PancakeSwap.

Uncertainty remains around the exact payload or phishing flow, as no page content has been captured. Defenders should continue to block the domain at network perimeter, add the IP address 104.21.51.188 to deny‑list rules, and monitor for any future re‑registration attempts. Updating DNS sinkhole feeds with the domain and associated IP, and ensuring endpoint protection solutions receive the latest threat intel from the blocklists, will reduce exposure. Ongoing observation of Cloudflare‑hosted IP ranges for similar impersonation patterns is recommended.