pancakeswap-th[.]web[.]app

Analysis of pancakeswap-th.web.app on July 24, 2026 shows a domain that was actively serving a web page with the title CupcakeSwap before being taken offline. The site returned HTTP 404 at the time of observation, indicating the content was no longer reachable. The domain resolves to IP 199.36.158.100, an address owned by Fastly, Inc. (AS54113) located in the United States, and is hosted on Firebase infrastructure, as evidenced by the presence of Firebase, HSTS, and HTTP/3 technologies. Registration metadata points to Google LLC as the registrar, and the TLS certificate is issued by Google Trust Services under the WR4 certificate profile, confirming the use of Google‑controlled HTTPS.

VirusTotal scans flagged the domain on 2 of 95 security vendors, and the domain appears on a single public blocklist, where it is listed as blocked by PhishDestroy. The site was identified as a crypto‑scam impersonating PancakeSwap, the popular decentralized exchange, while the page title CupcakeSwap suggests a possible variant or copy‑cat naming scheme. No nameserver information is available, consistent with Firebase‑hosted web.app subdomains. Although the site is no longer active, the observed indicators – IP ownership, hosting stack, SSL details, and vendor detections – provide a reliable fingerprint for defensive controls.

Security teams should ensure that the IP address 199.36.158.100 is added to network‑level blocklists where appropriate, and that any URLs matching the pancakeswap-th.web.app pattern are denied by web filters. Continuous monitoring of Firebase‑hosted subdomains for similar title or brand references is advisable, as the underlying hosting environment enables rapid deployment of look‑alike domains. The limited detection footprint (2 vendor flags and a single blocklist entry) underscores the need for proactive rule creation rather than reliance on reputation alone.