pancake-about-eat[.]at

Analysis of pancake-about-eat.at, observed on July 23, 2026, shows multiple indicators consistent with a crypto‑related brand‑impersonation campaign targeting PancakeSwap. The domain was registered on February 3, 2025 through 1API GmbH, a registrar listed in the Austrian NIC database, and is hosted on a single IPv4 address (95.129.234.38) that resolves to the Russian autonomous system AS57724 operated by DDOS‑GUARD LTD. No SSL certificate is present, meaning the site does not support HTTPS and cannot present a valid TLS handshake. HTTP requests return a generic "404 Error" page title, suggesting the content is either removed or never served.

The domain currently reports an offline status, and it has been added to at least one public blocklist and actively blocked by the PhishDestroy mitigation service. VirusTotal scans have recorded 16 detections out of 95 security vendors, reinforcing the suspicion of malicious intent. Gridinsoft assigns the domain a trust score of 0 out of 100, indicating a high likelihood of abuse. Nameservers are hosted on Cloudflare (noel.ns.cloudflare.com and sloan.ns.cloudflare.com), a common choice for fast‑flux or evasive infrastructure, but no additional evidence of dynamic DNS or fast‑flux behavior is available.

The combination of brand impersonation of PancakeSwap, a crypto scam classification, a low‑reputation IP address, lack of TLS, and multiple vendor detections suggests that the domain was used to lure victims into fraudulent cryptocurrency interactions. Defenders should continue to block the domain at perimeter defenses, monitor DNS queries for the associated IP and Cloudflare nameservers, and add the domain to internal blacklists. Threat‑intel teams should correlate any observed traffic to the IP 95.129.234.38 with other known PancakeSwap‑related phishing campaigns, and consider sharing the indicator set with industry ISACs to improve collective detection.