pancakeswapfx[.]serveftp[.]com

The domain pancakeswapfx.serveftp.com was registered on 21 February 2026 and is presently offline. Infrastructure analysis shows it resolves to the IP address 45.33.65.77, which belongs to the Akamai Connected Cloud network (AS63949) located in the United States. The host presents an HTTPS certificate issued to PhishDestroy and botadmin.destroy.tools, indicating that the site was deliberately associated with a known anti‑phishing organization, a tactic often used to lend false credibility. An HTTP request to the root returned status code 200 and a page title of “Index of /”, suggesting a directory listing without additional content.

The site was flagged by a single security blocklist and is listed by PhishDestroy as blocked. VirusTotal scans recorded detections from ten of ninety‑three antivirus and URL‑reputation engines, reinforcing the malicious classification. Gridinsoft assigned a trust score of 1 out of 100, the lowest possible rating. The domain is attributed to a crypto‑scam campaign that impersonates the PancakeSwap brand, aligning with the provided brand target and scam type.

While the exact phishing kit or payload has not been publicly disclosed, the convergence of a recent registration date, low‑reputation hosting, malicious SSL metadata, and multiple vendor detections provides strong evidence of intentional brand impersonation. Defenders should add the domain and its resolved IP to blocklists, monitor DNS queries for similar sub‑domains under the serveftp.com zone, and enforce outbound filtering for SSL certificates issued to PhishDestroy or botadmin.destroy.tools. Continuous re‑evaluation is advised in case the site is re‑activated, and any observed traffic should be correlated with the identified indicators of compromise.