pancakeswap[.]finance-beta-service-alpha-online[.]pro

This domain, pancakeswap.finance-beta-service-alpha-online.pro, is an active phishing site impersonating PancakeSwap, a decentralized exchange platform. Analysis indicates the domain was registered through Cloudflare, Inc. and currently resolves to the IPv6 address 2606:4700:3035::6815:5577. The site is associated with an airdrop scam phishing kit, a common tactic targeting cryptocurrency users with fraudulent token distributions. As of July 12, 2026, the domain remains active but returns a 520 error, suggesting either server misconfiguration or intentional obfuscation of its malicious content. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3, which may complicate detection and takedown efforts. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while masking the site's true intent. The domain appears on two security blocklists (PhishDestroy and BLP-Malware), and two of 95 security vendors on VirusTotal have flagged it as malicious. Gridinsoft assigns a trust score of 0/100, further corroborating its high-risk status. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activities occur. The use of Cloudflare infrastructure and the airdrop scam classification suggest this campaign may persist or reappear under similar domains. Monitoring for related subdomains or newly registered lookalike domains is recommended. The exact content of the phishing page remains unanalyzed, but the combination of brand impersonation, known phishing kit association, and blocklist presence confirms its malicious intent.