pancakesvep[.]co[.]com

The domain pancakesvep.co.com was observed hosting a site that used the page title “PancakeSwap - Premium Franchised Breakfast Cafes,” indicating a deliberate attempt to mimic the PancakeSwap brand. The site was classified as a crypto‑scam impersonating PancakeSwap, and it was listed on a single security blocklist and flagged by PhishDestroy. Infrastructure analysis shows the domain resolves to the IPv6 address 2a06:98c1:3120::3, which is allocated to Cloudflare, Inc. (AS13335) and geolocated to the United States. The domain uses Cloudflare nameservers jessica.ns.cloudflare.com and tate.ns.cloudflare.com, but it does not present an SSL/TLS certificate, leaving the HTTPS handshake incomplete.

The site was scanned by VirusTotal, where 95 anti‑malware engines evaluated the content and returned no detections; however, the absence of a detection does not constitute a safety assurance. The domain’s current status is offline, and no live HTTP response was captured at the time of analysis. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been delivered before takedown, as the page content has not been archived and no screenshots are available.

Defenders should continue to block the domain at the DNS and network layers, monitor for any resurgence of the same hostnames or similar sub‑domains, and update detection signatures to include the observed page title and the Cloudflare IPv6 address. Threat intelligence feeds should be updated to reflect the impersonation of PancakeSwap, and organizations that use PancakeSwap services should alert users to verify URLs carefully, especially when encountering unexpected breakfast‑cafe references. Ongoing observation of the associated IP range is recommended, as Cloudflare infrastructure is frequently reused by unrelated benign services, which can produce false positives if not properly scoped.