pancakeswap-rectifier[.]pages[.]dev

Analysis of pancakeswap-rectifier.pages.dev shows a newly registered domain (created 12 March 2026) that was actively serving a page titled "PancakeSwap - Troubleshooting & Support" before being taken offline. The HTTP response returned a 403 status code, indicating that the server is configured to deny direct access, a behavior often observed in malicious drop sites that rely on indirect traffic. Infrastructure inspection reveals the domain resolves to IP 172.66.44.189, an address owned by Cloudflare (AS13335) located in the United States. Both authoritative name servers belong to Cloudflare (ruth.ns.cloudflare.com and wilson.ns.cloudflare.com), and registration was performed through Cloudflare, Inc., consistent with many fast‑flux phishing operations that exploit the provider’s DNS and CDN services. The site leveraged Tailwind CSS, HSTS, and HTTP/3, suggesting a relatively modern front‑end stack despite its brief lifespan.

Reputation services uniformly flag the domain as hostile: Gridinsoft assigns a trust score of 0 out of 100, Scamadviser rates it 1 out of 100, and PhishDestroy has already added the domain to its blocklist. VirusTotal scans report 16 detections out of 94 security vendors, reinforcing the malicious classification. The SSL certificate is identified as type E8, and the overall threat type is listed as Wallet/Seed Phishing, targeting users of the PancakeSwap decentralized exchange by impersonating its brand. The page title mirrors legitimate support terminology, a common tactic to lure victims into disclosing wallet seeds.

Given the corroborating evidence—multiple low trust scores, a high‑confidence blocklist entry, and a substantial VirusTotal detection count—defenders should treat the domain as confirmed malicious. Recommended mitigations include adding the domain to DNS and URL filtering policies, monitoring outbound requests for connections to the associated Cloudflare IP range, and alerting users about the impersonation attempt.