proposal-pendle[.]xyz

The domain proposal-pendle.xyz was registered through Dynadot LLC on 27 February 2026 and is hosted behind Cloudflare’s network (AS13335) using the IP address 172.67.196.6. The authoritative nameservers aldo.ns.cloudflare.com and arya.ns.cloudflare.com resolve the domain to Cloudflare’s edge, and the site served an HTTPS certificate from Let’s Encrypt (E7) supporting HTTP/3. A page title retrieved from the server reads “Dashboard | Pendle”, indicating a targeted brand impersonation of the Pendle service. Automated scans returned an HTTP 404 response, and the site is currently listed as offline.

VirusTotal recorded two detections out of ninety‑three scanned security vendors, and Google Safe Browsing flagged the domain for social‑engineering content. The domain appears on a single public blocklist and is specifically blocked by the PhishDestroy feed. These indicators collectively confirm that the domain was used for a brand‑impersonation campaign aimed at Pendle users, although the exact payload or credential‑collection page has not been captured. Uncertainty remains regarding the full malicious payload, the duration of active hosting, and whether additional infrastructure such as command‑and‑control servers or secondary domains were associated with this campaign.

The offline status and 404 response limit immediate exploitation, but the underlying registration and hosting pattern could be reused for future impersonation attempts. Defenders should add proposal-pendle.xyz to network‑level block lists, enforce DNS filtering, and monitor the associated Cloudflare IP range for any resurgence. Email gateways should be updated to flag messages referencing “Pendle” that originate from this domain or its IP. Continuous observation of Dynadot registrations for similarly patterned domains and periodic re‑scanning of the IP address are recommended to detect re‑activation or related threats.