pendle[.]finance-markets[.]org

PhishDestroy identifies pendle.finance-markets.org as a confirmed brand impersonation domain designed to deceive users into divulging sensitive information under the guise of the legitimate Pendle platform. This domain, registered on April 14, 2025, was engineered to exploit user trust in the Pendle brand by mirroring its official domain structure with minor but critical variations. The threat actor behind this scheme leveraged a domain resembling 'pendle.finance-markets.org' to host a fraudulent landing page titled 'www.pendle.finance-markets.org,' which closely mimicked Pendle's legitimate interfaces to harvest login credentials or other sensitive data. This domain was flagged by 2 out of 95 security vendors on VirusTotal, indicating a low but non-zero detection rate, which underscores the stealthy nature of the impersonation. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar that has, at times, been associated with domains linked to malicious activities. The domain resolved to IP address 185.114.97.3 and utilized a Google Trust Services SSL certificate, which may have contributed to its perceived legitimacy. While the domain has since been taken offline, its brief operational window demonstrates the evolving tactics of threat actors who capitalize on brand recognition and time-sensitive trust to execute credential theft campaigns. Users who may have visited or interacted with pendle.finance-markets.org should immediately review their account credentials for any Pendle-related services and enable multi-factor authentication where available. If any suspicious login attempts were detected, users should reset their passwords immediately and monitor their accounts for unauthorized activity. Additionally, report any interactions with this domain to your organization's security team or through official phishing reporting channels to help prevent further exploitation. Always verify domain names and use official channels for financial or platform-related interactions to avoid falling victim to such impersonation schemes.