# PhishDestroy domain threat record: pendle-ecosystem.xyz

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/pendle-ecosystem.xyz/
Machine-readable companion: https://phishdestroy.io/domain/pendle-ecosystem.xyz/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 01:26:26 UTC
- Last availability or vendor check: 2026-10-21 22:32:51 UTC
- Stored record updated: 2026-10-22 14:23:43 UTC
- VirusTotal detections in the stored snapshot: 4/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Pendle

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Eranet International Limited
- Registrar country in stored WHOIS data: US
- Registration date (registry RDAP, pendle-ecosystem.xyz): 2026-09-27 17:18:54 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0ead9-01e3-76cf-856e-26690c41fa9f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/pendle-ecosystem.xyz
- Certificate Transparency search: https://crt.sh/?q=%25.pendle-ecosystem.xyz
- Web Archive lookup: https://web.archive.org/web/*/https://pendle-ecosystem.xyz/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
pendle-ecosystem.xyz posed as Pendle, the DeFi yield-trading protocol, and presented itself under Pendle's own tagline, "Pendle - Liberating Yield". Its audience was Pendle users and yield farmers who might take an "ecosystem" domain for an official extension of the project. PhishDestroy first flagged it on 2026-09-29. The site has been offline since 2026-09-30, and it was still dead when last checked on 2026-10-19.

How the scam works
Pages like this copy the look and wording of the real Pendle interface, so a visitor arriving from an ad, a social reply or a direct message sees what appears to be the genuine app. Fake DeFi front-ends of this kind usually ask the visitor to connect a wallet. They then push signature or token-approval requests that hand the attacker permission to move the victim's assets. Because the page borrows Pendle's real title, the usual check of glancing at the browser tab gives no warning, and only the domain itself reveals the fake.

Evidence
Detection by general antivirus engines was thin. VirusTotal showed 4 of 91 engines flagging the domain on 2026-09-29, from alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft and LevelBlue. Crypto-focused defenses were firmer: MetaMask's phishing list and SEAL both block it alongside PhishDestroy. In practice, wallet users were better protected here than people relying on a browser or endpoint scanner alone.

Infrastructure
The domain was registered through Eranet International Limited on 2026-09-27, just two days before PhishDestroy caught it. It went dark the day after detection. That short life fits a disposable campaign domain, set up to catch traffic quickly and then dropped. It sat behind Cloudflare, Inc. on an address geolocated to Canada, so the real origin server is hidden behind the proxy.

What to do
If you connected a wallet to pendle-ecosystem.xyz, review and revoke any token approvals or permissions you granted during that session using a trusted approval-checker. Move any remaining funds to a fresh wallet if you signed anything you did not fully understand. If you typed a seed phrase into the site, treat that wallet as compromised and empty it into a new one immediately. Always reach Pendle through a saved bookmark rather than links from search ads or messages. Defenders should add the domain to DNS and proxy blocklists and watch for lookalike "ecosystem" variants of DeFi brands registered by the same pattern.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0ead9-01e3-76cf-856e-26690c41fa9f/
VirusTotal report: https://www.virustotal.com/gui/domain/pendle-ecosystem.xyz
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pendle-ecosystem.xyz
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:25 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png
  Captured: 2026-09-29 01:48:59 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0ead9-01e3-76cf-856e-26690c41fa9f.png
  Captured: 2026-09-29 01:48:59 UTC
  Source report: https://urlscan.io/result/01a0ead9-01e3-76cf-856e-26690c41fa9f/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e45f-3b94-72eb-80ff-0ad81bc270fc.png
  Captured: 2026-09-29 01:26:26 UTC
  Source report: https://urlscan.io/result/01a0ead9-01e3-76cf-856e-26690c41fa9f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/431f7bba-2129-4b29-a419-18cf6b62a617.png
  Captured: 2026-09-29 01:29:48 UTC
  Source report: https://radar.cloudflare.com/scan/431f7bba-2129-4b29-a419-18cf6b62a617
  SHA-256: 1fcba51a4acb20599f369a8f7c058da58ea03bee3647326f5fa418d5bd1567d6
- URLQuery: https://screenshots.phishdestroy.io/uq/daa62b03-2b0e-437f-a094-e2331d9837d8.png
  Source report: https://urlquery.net/report/daa62b03-2b0e-437f-a094-e2331d9837d8
  SHA-256: 4de2b3891d6f1d1eddb8cec164ed1056e189018afd287f9238093290cac2d347
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e45f-30ec-71ad-923e-eb9dabc727f1.png
  Captured: 2026-09-27 19:37:30 UTC
  Source report: https://urlscan.io/result/01a0e45f-30ec-71ad-923e-eb9dabc727f1/
  SHA-256: ecbc1fe97fdcd3db2c4e28af26696773b8e7d285d96f0956d4892adc2eca9fed
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e45f-3b94-72eb-80ff-0ad81bc270fc.png
  Captured: 2026-09-27 19:38:54 UTC
  Source report: https://urlscan.io/result/01a0e45f-3b94-72eb-80ff-0ad81bc270fc/
  SHA-256: e0f4551214b1b160cc0778359ed76ac5d60cb7568b85f091ec9bec73befcbed7
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eac7-344e-7036-bbbf-f363a78d9e7a.png
  Captured: 2026-09-29 01:29:11 UTC
  Source report: https://urlscan.io/result/01a0eac7-344e-7036-bbbf-f363a78d9e7a/
  SHA-256: 9c9183a7462f277c21835a5ab422b8c654e16aa65929beef5431a4079ab96fbc
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eaca-b199-771b-a7fd-5f562fd2c3ec.png
  Captured: 2026-09-29 01:32:40 UTC
  Source report: https://urlscan.io/result/01a0eaca-b199-771b-a7fd-5f562fd2c3ec/
  SHA-256: 96fb7073da70b100e1b78abf10162a02d245a0baa490719eb36c5a22cdc1e01c
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eacb-f3ee-71fd-9375-e7af47792107.png
  Captured: 2026-09-29 01:34:00 UTC
  Source report: https://urlscan.io/result/01a0eacb-f3ee-71fd-9375-e7af47792107/
  SHA-256: 3208c53a86d869b72acc0d38ee08234c277b94bfafa8f3f1b64146213a98dc7a
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ead0-9e40-71b7-bc96-74186b04ee88.png
  Captured: 2026-09-29 01:39:10 UTC
  Source report: https://urlscan.io/result/01a0ead0-9e40-71b7-bc96-74186b04ee88/
  SHA-256: 635b5943008a5b2001833c76d6bf616cc4f47b19d1cb2ff247d473236608409b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:12Z",
        "uuid": "01a0ead9-01e3-76cf-856e-26690c41fa9f",
        "scanned_at": "2026-09-29T01:48:17Z",
        "final_url": "https://pendle-ecosystem.xyz/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://pendle-ecosystem.xyz/",
                "from": "http://pendle-ecosystem.xyz/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "gateway.irys.xyz",
            "esm.sh",
            "arbitrum.meowrpc.com",
            "arbitrum.gateway.tenderly.co",
            "arbitrum.drpc.org",
            "rpc.ankr.com",
            "arbitrum-one.publicnode.com",
            "arb1.arbitrum.io",
            "fonts.gstatic.com",
            "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com",
            "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com",
            "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com",
            "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com",
            "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com",
            "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com",
            "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com",
            "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com",
            "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com",
            "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com",
            "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com",
            "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com",
            "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com",
            "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com",
            "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com",
            "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com",
            "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com",
            "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com",
            "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com",
            "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com",
            "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com"
        ],
        "ips": [
            "142.251.14.94",
            "104.21.15.158",
            "172.67.163.26",
            "172.66.167.42",
            "142.251.127.95",
            "104.26.13.205",
            "104.26.15.209",
            "151.101.129.229",
            "104.21.17.203",
            "104.26.10.181",
            "35.227.193.242",
            "104.18.11.59",
            "152.236.9.75",
            "172.66.150.162",
            "104.20.39.96"
        ],
        "asns": [
            "15169",
            "13335",
            "54113",
            "396982",
            "396356"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "www.pendle.finance",
            "boros.pendle.finance",
            "app.pendle.finance",
            "medium.com",
            "github.com",
            "t.me",
            "www.coingecko.com",
            "defillama.com",
            "app.sentio.xyz",
            "tokenterminal.com",
            "docs.pendle.finance",
            "x.com",
            "pendle.finance"
        ],
        "social": [
            "https://medium.com/pendle",
            "https://github.com/pendle-finance/pendle-core-v2-public",
            "https://t.me/pendle_info_bot",
            "https://x.com/pendle_fi"
        ],
        "doc_hash": "c47794660de015ae4bf829cdd3eaffc70d1adf2507a89947459051a4aa22e55b",
        "script_hashes": [
            "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c"
        ],
        "globals": [
            "requestResize",
            "selectDate",
            "submitVote",
            "closeConfirm",
            "__earlyClickAction",
            "__removeEarlyClick",
            "Cap",
            "downloadLogsBlobInBrowser"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.pendle-ecosystem.xyz",
                "pendle-ecosystem.xyz"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "pendle-ecosystem.xyz",
            "protocol": "QUIC",
            "valid_to": "2026-12-26T16:51:06Z",
            "valid_from": "2026-09-27T16:51:07Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 148,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:50Z",
        "uuid": "431f7bba-2129-4b29-a419-18cf6b62a617",
        "scanned_at": "2026-09-29T01:29:48Z",
        "final_url": "https://pendle-ecosystem.xyz/",
        "status": 200,
        "history": [
            {
                "url": "https://pendle-ecosystem.xyz/",
                "status": 200
            }
        ],
        "dom_hash": "5336fab5d5b73f2cc61d5638b56af6141e1af9f2d2527c9d79af9ab8a0de12ce",
        "doc_hash": "8bc98cdf3270e20b665db0ff28816fe0430b03b72034a9e84a3faa2d00b2e4ab",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "pendle-ecosystem.xyz",
                "type": "A",
                "value": "172.67.168.117"
            },
            {
                "name": "pendle-ecosystem.xyz",
                "type": "A",
                "value": "104.21.46.112"
            },
            {
                "name": "pendle-ecosystem.xyz",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:2e70"
            },
            {
                "name": "pendle-ecosystem.xyz",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:a875"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.168.117",
        "whois": {
            "registrar": "Eranet International Limited",
            "created": "2026-09-27T17:18:54Z",
            "updated": "2026-09-27T17:18:55Z",
            "expires": "2027-09-27T23:59:59Z",
            "nameservers": [
                "athena.ns.cloudflare.com",
                "damien.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:44:04Z",
        "analysis_at": "2026-10-14T07:20:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 38
        },
        "detections": {
            "LevelBlue": "phishing",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "registrar": "ERANET INTERNATIONAL LIMITED",
        "created": "2026-09-28T01:18:54Z",
        "expires": "2027-09-27T23:59:59Z",
        "updated": "2026-09-28T00:00:00Z",
        "first_seen": "2026-09-27T18:02:44Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "athena.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "damien.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "athena.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:2e70"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.46.112"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.168.117"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:a875"
            }
        ],
        "dns_at": "2026-09-28T23:58:25Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.pendle-ecosystem.xyz",
                "pendle-ecosystem.xyz"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "571426f4786a71deef2eea70858337a35f5",
            "sha256": "b520e870065c65ad18d0808c3125cd69e8fa891bd8dcf6b32e04c82ed4f40ea9",
            "subject": "pendle-ecosystem.xyz",
            "valid_to": "2026-12-26T16:51:06Z",
            "valid_from": "2026-09-27T16:51:07Z"
        },
        "whois": {
            "registrar": "ERANET INTERNATIONAL LIMITED",
            "registrar_iana_id": "1868",
            "registrar_url": "http://www.eranet.com",
            "created": "2026-09-27T17:18:54Z",
            "updated": "2026-09-27T17:18:55Z",
            "expires": "2027-09-27T00:00:00Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "athena.ns.cloudflare.com",
                "damien.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```