pancakeswap[.]finance-edge-swap-app-auth[.]cloud

This domain, pancakeswap.finance-edge-swap-app-auth.cloud, operates as a crypto drainer under the guise of the legitimate PancakeSwap decentralized exchange platform. Analysis indicates the site is designed to trick users into connecting their cryptocurrency wallets, subsequently draining funds through malicious smart contract interactions or approvals. The domain specifically mimics PancakeSwap's branding, including visual design elements and URL structure, to deceive users into believing they are interacting with the official service. Such attacks are particularly effective against users unfamiliar with the technical nuances of decentralized finance platforms, where transaction approvals are irreversible once executed on-chain. Evidence supporting the malicious nature of this domain includes detection by 10 out of 95 security vendors on VirusTotal, indicating a consensus among multiple threat intelligence sources. The domain was registered on October 18, 2025, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to IP address 104.21.89.15, hosted on AS13335 Cloudflare, Inc., a common proxy service used to obfuscate the true origin of malicious infrastructure. Additionally, the domain appears on one security blocklist and lacks a valid SSL certificate, further signaling its illegitimate status. The creation date suggests recent deployment, aligning with observed trends in short-lived phishing domains targeting cryptocurrency users. Users who visited pancakeswap.finance-edge-swap-app-auth.cloud should immediately revoke any wallet approvals or smart contract interactions conducted through the site. This can be done using blockchain explorers or wallet management tools to review and revoke suspicious permissions. Affected users should also monitor their wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet if compromise is suspected. It is critical to verify domain authenticity by cross-referencing official communications from PancakeSwap, as impersonation domains often employ slight variations in URL structure to evade detection. No further interaction with the domain should occur, and any credentials or recovery phrases entered should be considered compromised.