s1-pendle[.]app

This domain is flagged for brand impersonation targeting Pendle, a decentralized finance protocol. The threat type involves presenting a fraudulent interface under the pretext of Pendle's services, likely to harvest credentials or execute unauthorized transactions. Analysis indicates the domain was specifically crafted to deceive users seeking Pendle-related infrastructure, as evidenced by the page title 'Aether Infrastructure.' Infrastructure analysis reveals the domain s1-pendle.app was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and is currently offline. The domain appears on 3 security blocklists and is referenced in 2 AlienVault OTX threat intelligence pulses. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services, and the site employs Cloudflare with HTTP/3 support. Gridinsoft assigns a trust score of 0/100, further confirming its malicious nature. Mitigation for this brand impersonation threat involves immediate domain blocking at the network level. Users should verify the legitimacy of any Pendle-related portal by cross-referencing official communication channels for authentic URLs. Organizations should monitor for connections to 188.114.97.3 and the domain registrar NICENIC INTERNATIONAL GROUP CO., LIMITED in logs. Security teams are advised to update detection rules to include this domain and its associated indicators, particularly in environments where Pendle or similar DeFi platforms are accessed.