pancakeswap2sj[.]pages[.]dev

This domain, pancakeswap2sj.pages.dev, operates as a brand impersonation scam targeting users of the Across decentralized finance protocol. The site mimics legitimate PancakeSwap branding, presenting a fraudulent interface designed to deceive visitors into connecting cryptocurrency wallets. Analysis indicates the domain functions as a crypto drainer, tricking users into approving malicious smart contracts that siphon funds from connected wallets without authorization. The page title, 'PancakeSwap Finance: Swap, Earn, and Grow in DeFi,' reinforces the deception by closely replicating the authentic platform's messaging and visual identity. Evidence supporting the malicious classification includes detection by 20 out of 95 security vendors on VirusTotal, with the domain appearing on one security blocklist. Infrastructure analysis reveals the domain was registered on January 24, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.204, hosted on AS13335 Cloudflare, Inc. in the United States. The SSL certificate is classified as WE1, and the domain is explicitly flagged for impersonating Across, a known DeFi platform. The combination of brand impersonation, recent registration, and low detection volume suggests a targeted campaign with evolving evasion tactics. Users who visited pancakeswap2sj.pages.dev should immediately revoke any smart contract approvals granted through the site using a wallet management tool. All connected wallets should be audited for unauthorized transactions, and funds should be transferred to a new wallet if suspicious activity is detected. Browser data, including cookies and cached content, should be cleared to eliminate residual tracking elements. Users are advised to verify domain authenticity by cross-referencing official project communications and avoiding interaction with sites hosted on untrusted infrastructure, particularly those using content delivery networks to obscure origin.