pancakeswap[.]in

Analysis of the domain pancakeswap.in, observed on July 23, 2026, shows clear evidence of a brand‑impersonation infrastructure targeting users of the PancakeSwap decentralized exchange. The domain was registered on February 21, 2026 through GoDaddy.com, LLC and is hosted on Cloudflare’s network (AS13335) with the IP address 188.114.96.3 located in the United States. DNS resolution uses the Cloudflare nameservers cody.ns.cloudflare.com and oaklyn.ns.cloudflare.com, and the site serves over HTTP/3 with a 301 redirect response, indicating intentional traffic manipulation. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint but offering no protection against the underlying malicious content. The page title returned by the server is "Exchange | PancakeSwap," directly mirroring the legitimate brand’s terminology and reinforcing the impersonation claim.

Multiple threat‑intel feeds have flagged the domain: it appears on four security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Gridinsoft’s trust scoring system assigns a score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows that 12 of 93 security vendors have flagged the domain, reinforcing its malicious classification. The combination of Cloudflare hosting, a trusted SSL certificate, and the use of a brand‑specific page title suggests a deliberate attempt to evade naïve detection while luring victims into crypto‑related scams.

While the exact phishing page content has not been captured in this report, the available telemetry—registration details, hosting infrastructure, blocklist presence, and vendor detections—provides sufficient confidence to label the domain as an active, high‑risk impersonation site. Defenders should add pancakeswap.in to network‑level blocklists, enforce URL filtering for any references to PancakeSwap, and monitor for outbound connections to the IP 188.114.96.3.