panswap[.]app

PhishDestroy identifies panswap.app as a domain actively distributing a generic phishing drainer kit, masquerading as a legitimate cryptocurrency platform. This domain is not associated with the legitimate PancakeSwap ecosystem, which operates under the domain pancakeswap.finance. The threat involves malicious payloads designed to deceive users into connecting their crypto wallets, enabling attackers to drain digital assets under the guise of a token swap or yield farming service. Investigators have flagged the domain’s suspicious infrastructure, including TLS certificates and domain registration patterns typical of cryptocurrency drainer operations.

This domain was flagged with a VirusTotal detection score of 3/95, indicating no immediate antivirus or security tool alerts despite its malicious intent. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar often exploited by threat actors for anonymity. panswap.app resolves to the IP address 172.67.200.165, which is linked to multiple phishing campaigns, and was created on April 20, 2026—unusually recent for a functional platform. The domain utilizes a Let's Encrypt SSL certificate, a tactic to appear legitimate. As of this report, the domain remains unblocked by Google Safe Browsing (GSB) and has not been flagged by major threat intelligence platforms, leaving users vulnerable to exposure.

As of the latest assessment, panswap.app is classified as 'active' with a risk level marked 'under_investigation,' indicating ongoing scrutiny rather than confirmed safe status. PhishDestroy advises users to avoid interacting with this domain due to its association with cryptocurrency drainer kits and the absence of proactive blocking measures. Users who suspect exposure should revoke any wallet connections to panswap.app immediately, monitor transactions for unauthorized activity, and report the domain to relevant cybersecurity authorities. The residual risk remains high, with potential for further malicious updates or expanded targeting. Immediate action is recommended to mitigate financial and data exposure.