Phishing Analysis: PancakeSwap

Captura Visual

Informações de Detecção

https://www.web.pancake.run/

Detected Brand

PancakeSwap

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

33bc2f62-367…

Analyzed

2026-04-08 12:04

Final URL (after redirects)

https://web.pancake.run/

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1B093E8E592B075F94117AFD8DB32BEAA755B30BFFFA28784837847A16683D94D448C00
CONTENT ssdeep	1536:WXfbX0KQlQLfUUoClQLfUUQlQLfUUzJ4CFf5l+ckyFm+9ftidZ5m9b:WQIBIQIpF3M0

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	d5d455d455d55454
VISUAL aHash	7ec1800000000000
VISUAL dHash	e003000000000000
VISUAL wHash	7efcf8f0f0e0c0c0
VISUAL colorHash	07000200180
VISUAL cropResistant	e003000000000000

Análise de Código

Risk Score 100/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

WebSocket C2 🔥 Firebase Backend

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
hex_escape
unicode_escape
base64_strings

🎯 Kit Endpoints

https://blog.pancakeswap.finance/
https://blog.pancakeswap.finance
solana:signAndSendTransaction
solana_signAndSendTransaction

📡 API Calls Detected

https://proofs.pancakeswap.com/cms-config/tokens-routing-config.json
/__cookies__
https://api.blocto.app/networks/evm
https://www.google.com/ccm/geo
0x3b3b57de
account
POST
https://aptos.pancakeswap.finance
/api/home
stats
/api/paymaster
proxy
https://obj-cache.pancakeswap.com
https://raw-api.pancakeswap.com/ondo/market-status
GET
https://raw.githubusercontent.com/pancakeswap/airdrop-v3-users/master/forFE.json
logs
https://raw-api.pancakeswap.com/ondo/status
https://api-v3.raydium.io/main/auto-fee
https://proofs.pancakeswap.com/cms-config/routing-base-config.json
/api/auth/telegram-callback

☁️ Cloud Backend

Firebase: pancakeswap-prod-firebase.firebaseapp.com

📊 Detalhamento da Pontuação de Risco

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info

Real-time C2

WebSocket-based Command & Control infrastructure for real-time victim monitoring

Code Obfuscation

JavaScript code obfuscated using 1759 technique(s) to evade detection

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

PancakeSwap users

Método de Ataque

real-time WebSocket exfiltration + obfuscated JavaScript

Canal de Exfiltração

Firebase Database + WebSocket (174 endpoints)

Avaliação de Risco

CRITICAL - Automated credential harvesting with Firebase Database + WebSocket (174 endpoints)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
Kit signatures: angler
1759 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

PancakeSwap

Official Website

N/A

Fake Service

Banking/payment service

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.

Secondary Method: JavaScript Obfuscation

Malicious code is obfuscated using 1759 techniques to evade detection by security scanners and make reverse engineering more difficult.

Target Blockchain

Multiple blockchains

Whitelist Bypass

YES

Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domain

www.web.pancake.run

Registered

Unknown

Registrar

None

Status

Age unknown

Hosting Information

Provider

Unknown

ASN

🤖 AI-Extracted Threat Intelligence

Scan History for www.web.pancake.run

Found 1 other scan for this domain

http://www.web.pancake.run/ PancakeSwap Mar 31, 2026 23:17