pancakeswap-v3[.]org

This domain, pancakeswap-v3.org, is actively impersonating the legitimate decentralized finance platform PancakeSwap as of July 12, 2026. Infrastructure analysis reveals the domain was registered on March 11, 2026, through Dynadot LLC, with Cloudflare nameservers pola.ns.cloudflare.com and yichun.ns.cloudflare.com. The site resolves to IP address 104.21.52.174, hosted on AS13335 Cloudflare, Inc. in the United States. The page title, 'PancakeSwap: Top Exchange for DeFi Trading & Yields,' directly mirrors official branding, increasing the likelihood of successful deception among cryptocurrency users. The domain exhibits multiple indicators of malicious intent. A 530 HTTP status code suggests restricted access or misconfiguration, often seen in phishing infrastructure designed to evade detection. The SSL certificate, issued by Google Trust Services (WE1), is valid but does not mitigate the fraudulent nature of the site. Security vendor detection is substantial, with 8 out of 95 engines on VirusTotal flagging the domain as malicious. Additionally, the domain appears in 22 threat intelligence pulses on AlienVault OTX and is listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL. While the exact phishing kit or payload remains unconfirmed, the domain’s purpose aligns with cryptocurrency fraud, likely targeting users’ wallet credentials or private keys. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments handling decentralized finance transactions. Monitoring for related domains using similar naming conventions (e.g., 'pancakeswap-v2,' 'pancakeswap-defi') may help preempt further campaigns. Given the domain’s persistence since March 2026, continued vigilance is warranted.