blog[.]pancake[.]run

blog.pancake.run is a subdomain of pancake.run. PhishDestroy first observed the hostname on Sep 3, 2026. Stored content metadata identifies PancakeSwap as the apparent target. Current evidence score: 77/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, OpenPhish, and Cloudflare Radar. VirusTotal recorded 9 detections among 91 engines: ADMINUSLabs, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky, OpenPhish, Sophos on Sep 3, 2026 at 02:56 UTC. OpenPhish listed the hostname in the separate external-blocklist snapshot on Sep 3, 2026 at 02:20 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. Non-positive and contextual checks: Google Safe Browsing returned no flag on Sep 3, 2026 at 02:57 UTC. URLScan captured the page on Sep 3, 2026 at 00:50 UTC.

The collector marked the hostname reachable on Sep 3, 2026 at 00:50 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 76.76.21.98 on AS16509 (Amazon.com, Inc.). The IP and ASN identify shared Vercel edge infrastructure; the origin server is not established by this address. The evidence archive retains 2 visual captures from PhishDestroy and URLScan; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Oct 28, 2026; checked Sep 3, 2026 at 01:02 UTC.

The content indicators and 3 positive source findings support the current PancakeSwap impersonation and phishing classification. The target field identifies PancakeSwap, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.