Is pancakesswaps.finance a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

pancakesswaps.finance is a website on a ".finance" domain whose name reads as a variant of a well-known decentralised-exchange brand and suggests token-swap services. The only content it served to automated visitors was a bot-challenge interstitial with a minimal amount of text. No product pages, terms, or about content were retrievable, so its operator and business model cannot be confirmed from the site itself. Its apparent purpose is a crypto-asset swapping or trading front end.

Scam/Impersonation Risk

This is the dominant concern. Multiple major security vendors currently flag the domain as malicious, and the aggregated reputation data meets the threshold for a confirmed blacklist listing. That listing alone is decisive and cannot be offset by the site's technical hygiene. The name pairs a pluralised, slightly altered rendering of an established exchange brand with the word "swaps". This is a recognised pattern in lookalike-domain abuse. It is a naming observation, not a confirmed impersonation finding, but it fits the blacklist signal closely. No conflicting legal identities were observed. The homepage exposed too little content to assess specific product claims, so the risk rests on the third-party detections, the lookalike naming, and the very recent registration. During automated interaction testing the site made no outbound data transmissions and showed no wallet-draining or clipboard-manipulation behaviour. That is a neutral observation and does not reduce the detection-based risk. Evidence:

• Homepage: the only captured content was a bot-challenge interstitial of about 15 characters of text. No services, terms, or identity statements were visible.
• Reputation aggregation across the whole domain: 10 malicious and 2 suspicious verdicts, including three major endpoint-security vendors (Fortinet, Kaspersky, Sophos). The aggregate triggered an automatic critical-reputation override.
• Domain registration: created 2026-07-03 (~0.32 years, about 115 days old). The name was therefore registered only recently, which is consistent with lookalike-domain campaigns.
• Web archive: a single snapshot dated 2023-12-19 (1 snapshot, 1 year tracked). The name appears to have existed before its current registration, but the archive provides no meaningful continuity of content.

Regulatory Verification Notes

The site discloses no licence, registration, or legal entity on any retrievable page. For a site apparently offering financial-style trading services, that is a verification gap, not proof of wrongdoing by itself. Registrant details are incomplete, which constitutes ownership opacity, and the real-world operator could not be tied to any brand or person. The domain is not recognised in any decentralised-finance protocol directory, so there is no independent legitimacy to anchor it. No third-party broker or regulator-database record matched the domain. Evidence:

• Registration data: registrar Name.com, Inc.; registered 2026-07-03, expires 2027-07-03; registrant details incomplete.
• Transport security: TLS certificate issued by WE1 (DV, domain validation only), valid to 2026-11-30 with about 34 days remaining. DV confirms domain control only and says nothing about the operator.
• Hosting: served from AS13335 (CLOUDFLARENET, US).
• Homepage and legal pages: no company name, licence number, or jurisdiction was observable.

What to Verify Next

Any contact with this domain should first be checked against the exchange brand it resembles, using only addresses obtained independently. Typed-in, bookmarked, or officially published addresses on the genuine project's verified channels are acceptable sources. Links from search ads, social posts, or messaging apps are not. If a licence or registration is later claimed, it should be confirmed directly with the relevant registry. Official support and contact channels should also be established through an independent, offline route. Any wallet approvals previously granted to this domain should be reviewed and revoked. Evidence:

• Domain naming: the name differs from a widely known exchange brand only by pluralisation and added wording.
• Domain registration: the current registration began 2026-07-03, so any claim of long operating history should be treated as unsupported.
• Homepage: no disclosed entity or registry reference exists to check, so identity must be established externally.

Summary Verdict

The overall posture is high risk. Confirmed multi-vendor malicious detections, a lookalike brand name, and an unverified operator converge on a clearly cautionary assessment. Technical hygiene such as valid encryption and behaviourally quiet pages does not offset the external reputation findings. Available evidence does not support treating this domain as a legitimate service.

Infrastructure Integrity

The site sits behind Cloudflare's CDN/WAF. All four observed addresses are shared edge servers, and the origin server was not observable, so independent hosting verification is not possible and content could change without any visible trace. The single abuse report on record relates to a shared edge address used by many unrelated sites. It is attributed to the provider and discounted, not counted against this site. Protective infrastructure is a mitigating factor only and does not offset the reputation findings.

Closing Assessment

The site should be treated as unsafe for any sensitive interaction. Wallet connections, token approvals, credential entry, and deposits should be avoided, and no files should be downloaded from it. If the domain was reached through a link or message, that source should be treated as suspect and reported. Observation without interaction is the only tolerable use.

Signals weighed against the site

• AbuseIPDB: 1 report on hosting IP 2606:4700:3037::6815:2a3a (Cloudflare, Inc., Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.