event-pancake[.]net

Analysis of event-pancake.net confirms active deployment of cryptocurrency drainer malware, designed to intercept and divert blockchain transaction authorization requests. The domain resolves to IP address 172.67.142.244 and serves malicious JavaScript payloads targeting wallet extensions and dApp connectors. Threat actors leverage domain spoofing under the guise of event-related services to deceive users into granting unauthorized transaction permissions, resulting in immediate fund exfiltration upon signature approval.

Infrastructure analysis reveals critical technical indicators. The domain was registered through TUCOWS.COM, CO. on April 14, 2026, with an operational lifespan exceeding standard malicious domain rotation cycles. Current VirusTotal analysis shows 0 detections out of 95 engines as of the latest scan window, indicating evasion of signature-based detection mechanisms. The hosting infrastructure at 172.67.142.244 is associated with prior malicious campaigns, reinforcing the domain’s role within a coordinated threat network.

Users who accessed event-pancake.net or interacted with any derived subdomains should immediately inspect wallet extension permissions and revoke any unauthorized access granted to connected domains. Transaction histories should be reviewed for anomalous outbound transfers, particularly those occurring within minutes of site interaction. Network-level protections should be updated to include domain blocklisting for event-pancake.net and associated infrastructure. If wallet compromise is suspected, users must transfer remaining assets to a new wallet address with a freshly generated seed phrase. Continuous monitoring of transaction logs is advised to detect further unauthorized activity.