v3pancakeswap[.]finance

This domain, v3pancakeswap.finance, is actively flagged as a high-risk brand impersonation targeting PancakeSwap, a decentralized finance platform. Infrastructure analysis reveals the domain resolves to 104.21.16.1, hosted on Cloudflare's network (AS13335) in the US, a common pattern for scam operations leveraging CDN services to obscure origin servers. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent domains. It currently returns an HTTP 302 redirect status, which may indicate an attempt to evade detection or dynamically route victims to malicious endpoints. The page title, 'PancakeSwap Finance - Trade, Farm and Earn Crypto on BNB Smart Chain,' directly mirrors PancakeSwap's branding, confirming the intent to deceive users into believing the site is legitimate. Detected technologies include Bootstrap, jQuery, and Cloudflare, which are standard for both legitimate and malicious sites, offering no conclusive evidence of compromise but aligning with common scam infrastructure. The domain appears on at least one security blocklist and is blocked by PhishDestroy, further supporting its classification as malicious. While three of 95 security vendors on VirusTotal flag this domain, this detection rate alone does not confirm its full scope or payload. The SSL certificate, issued by Google Trust Services (WE1), is valid but provides no inherent trust, as certificates are easily obtainable. Nameservers (terry.ns.cloudflare.com, ximena.ns.cloudflare.com) are consistent with Cloudflare usage, which is neutral but typical for scam domains seeking resilience. Defenders should treat this domain as an active threat. Immediate actions include blocking resolution at the DNS level, monitoring for connections to 104.21.16.1, and alerting users to the risk of crypto scams. Given the domain's registration and hosting patterns, it is likely part of a broader campaign.