pancakewapsite[.]lat

This domain is flagged as an active cryptocurrency drainer site, specifically designed to intercept and divert cryptocurrency transfers to attacker-controlled wallets. The domain name 'pancakewapsite.lat' mimics legitimate cryptocurrency services by incorporating the term 'pancake,' commonly associated with 'PancakeSwap,' a decentralized exchange. The inclusion of 'wap' suggests a misappropriation of 'swap,' implying functionality related to token trading or liquidity provision. The suffix '.lat' is a country-code top-level domain (ccTLD) for Latin America, frequently exploited in fraudulent campaigns due to lax registration oversight. The drainer kit employed by this domain is likely a pre-packaged JavaScript-based toolkit designed to modify wallet transaction parameters in real time, redirecting funds to adversary-controlled addresses without user consent. Infrastructure analysis reveals that the domain resolves to a single IPv4 address, 188.114.96.3, which is hosted on a server associated with known malicious activity clusters. The domain was registered through Dynadot Inc, a registrar frequently abused for bulk malicious domain registrations due to its low verification barriers. As of the creation date of April 05, 2026, the domain has not been flagged by VirusTotal scanning engines, with 6 out of 95 detection engines identifying it as malicious. This indicates a potential delay in threat intelligence dissemination or evasion tactics employed by the threat actor. The domain remains unlisted on Google Safe Browsing (GSB) and has not been detected by major blocklists, allowing it to remain operational with minimal interference. The infrastructure further exhibits characteristics such as shared hosting with other suspicious domains, suggesting a coordinated campaign rather than an isolated incident. The current operational status of pancakewapsite.lat is active, with no observable takedown or mitigation efforts at this time. Given the absence of detections despite known malicious intent, the risk of user exposure remains high, particularly for individuals engaging with cryptocurrency platforms. Immediate response actions include domain blacklisting at the network perimeter, DNS sinkholing, and integration of threat intelligence feeds to detect related infrastructure. Users are advised to scrutinize URLs for misspellings or unusual TLDs, verify wallet addresses before transactions, and utilize hardware wallets or transaction simulation tools to detect unauthorized modifications. The residual risk remains elevated due to the domain's active status, lack of blocklist coverage, and the sophistication of crypto drainer toolkits, necessitating continuous monitoring and proactive threat hunting.