# PhishDestroy domain threat record: pendlefoundation.icu

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/pendlefoundation.icu/
Machine-readable companion: https://phishdestroy.io/domain/pendlefoundation.icu/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 04:33:35 UTC
- Last availability or vendor check: 2026-10-23 01:27:33 UTC
- Stored record updated: 2026-10-23 18:22:17 UTC
- VirusTotal detections in the stored snapshot: 3/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Pendle

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: Eranet International Limited
- Registrar country in stored WHOIS data: US
- Registration date (registry RDAP, pendlefoundation.icu): 2026-09-28 10:31:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eb72-5e51-7105-b1f0-aeb0be3436b9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/pendlefoundation.icu
- Certificate Transparency search: https://crt.sh/?q=%25.pendlefoundation.icu
- Web Archive lookup: https://web.archive.org/web/*/https://pendlefoundation.icu/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
pendlefoundation.icu is an impersonation phishing page that copied Pendle, the decentralized yield-trading protocol, under the page title "Pendle - Liberating Yield". The "foundation" wording in the domain makes it look like an official organization site, which helps it pass as legitimate with Pendle users and DeFi wallet holders. PhishDestroy first flagged it on 2026-09-29. The site has been offline since 2026-09-30, and its DNS was still inactive when we last checked on 2026-10-19.

How the scam works
The page reuses Pendle's own title and branding so that visitors think they are on the real protocol interface. Fake DeFi front-ends like this one usually ask the visitor to connect a wallet and then present a transaction or signature that looks routine, such as a claim, a deposit or a yield position. That request actually grants token approvals or transfers assets to the attacker. Anyone who signs it can lose the tokens covered by the approval, often without any further prompt.

Evidence
VirusTotal returned 3 detections out of 91 engines on 2026-09-29, from alphaMountain.ai, CRDF and Forcepoint ThreatSeeker. That count is low, which is common for a phishing domain caught within a day of going live. Support from wallet-focused sources is stronger. Besides PhishDestroy, the domain is on the MetaMask and SEAL blocklists, so MetaMask users get a warning before the page loads. It also appears in one AlienVault OTX threat pulse.

Infrastructure
The domain was registered on 2026-09-28 through Eranet International Limited, just one day before we detected it. It was down two days after registration, which is typical of short-lived phishing domains that are used briefly and then dropped. The site sat behind Cloudflare's network, with a Canada geolocation, so the real origin server stayed hidden. Its Let's Encrypt certificate gave it a browser padlock, which proves nothing about who runs a site.

What to do
If you connected a wallet to pendlefoundation.icu, review your token approvals with a revocation tool and revoke any you don't recognize, especially recent ones. If you signed a transaction there and still hold assets, move them to a fresh wallet. If you entered a seed phrase, treat that wallet as compromised and stop using it. Only reach Pendle from a bookmarked address you have verified yourself. Defenders should block the domain and use the timing pattern of fresh .icu registrations combined with "foundation" brand terms as a signal for hunting related domains.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb72-5e51-7105-b1f0-aeb0be3436b9/
VirusTotal report: https://www.virustotal.com/gui/domain/pendlefoundation.icu
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pendlefoundation.icu
Archived copy: https://web.archive.org/web/20260929043532/https://pendlefoundation.icu/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:18 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png
  Captured: 2026-09-29 04:37:10 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb72-5e51-7105-b1f0-aeb0be3436b9.png
  Captured: 2026-09-29 04:37:10 UTC
  Source report: https://urlscan.io/result/01a0eb72-5e51-7105-b1f0-aeb0be3436b9/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e7ec-4f10-74b0-b7bb-ca4a61944234.png
  Captured: 2026-09-29 04:33:35 UTC
  Source report: https://urlscan.io/result/01a0eb72-5e51-7105-b1f0-aeb0be3436b9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/088321d8-32d0-4675-83d1-f78746961ebd.png
  Captured: 2026-09-29 04:35:56 UTC
  Source report: https://radar.cloudflare.com/scan/088321d8-32d0-4675-83d1-f78746961ebd
  SHA-256: 0c705d5c51d6f019ce81193d9427a11616a5cd7d1ea2022b38a6d6ed0c89f4f9
- URLQuery: https://screenshots.phishdestroy.io/uq/a5f653bf-68c4-4722-a6c3-c79d8acb343e.png
  Source report: https://urlquery.net/report/a5f653bf-68c4-4722-a6c3-c79d8acb343e
  SHA-256: 1b1695c9d108209a73c0c1ac45a901c5603e1f0b6aa3735c5d47428d0b33af55
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e7ec-4f10-74b0-b7bb-ca4a61944234.png
  Captured: 2026-09-28 12:10:31 UTC
  Source report: https://urlscan.io/result/01a0e7ec-4f10-74b0-b7bb-ca4a61944234/
  SHA-256: 7d94e16f69eac7ee5151fe4e51c965dc4e8c5bf4495cbaeb43ef27fbd63fbfe2
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e7ec-4f88-7001-8987-2ec8766c40fd.png
  Captured: 2026-09-28 12:10:31 UTC
  Source report: https://urlscan.io/result/01a0e7ec-4f88-7001-8987-2ec8766c40fd/
  SHA-256: ca24ab1b1214e89701a6ae0f4cb9fe019f815f9a21300120d661edabba81a366
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb7f-3886-7098-8f86-16d9066f796b.png
  Captured: 2026-09-29 04:49:49 UTC
  Source report: https://urlscan.io/result/01a0eb7f-3886-7098-8f86-16d9066f796b/
  SHA-256: 4fe7638b39601783bfdcba395d605a2eef94bda5fd792607d509e10a3b7e635f
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ec75-7539-7436-80df-99c97a954ac3.png
  Captured: 2026-09-29 09:18:48 UTC
  Source report: https://urlscan.io/result/01a0ec75-7539-7436-80df-99c97a954ac3/
  SHA-256: 8d1dfe16f93b24a79542652ff10a0caacc08ad1be914847e8ba8888df8a990f8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:54:59Z",
        "uuid": "01a0eb72-5e51-7105-b1f0-aeb0be3436b9",
        "scanned_at": "2026-09-29T04:35:46Z",
        "final_url": "https://pendlefoundation.icu/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://pendlefoundation.icu/",
                "from": "http://pendlefoundation.icu/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "gateway.irys.xyz",
            "esm.sh",
            "arbitrum.meowrpc.com",
            "arbitrum.gateway.tenderly.co",
            "arbitrum.drpc.org",
            "rpc.ankr.com",
            "arbitrum-one.publicnode.com",
            "arb1.arbitrum.io",
            "fonts.gstatic.com",
            "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com",
            "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com",
            "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com",
            "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com",
            "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com",
            "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com",
            "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com",
            "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com",
            "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com",
            "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com",
            "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com",
            "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com",
            "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com",
            "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com",
            "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com",
            "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com",
            "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com",
            "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com",
            "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com",
            "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com",
            "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com"
        ],
        "ips": [
            "142.251.127.94",
            "172.67.163.26",
            "104.21.15.158",
            "104.20.31.170",
            "142.251.13.95",
            "172.67.74.152",
            "104.26.14.209",
            "104.17.208.5",
            "104.21.17.203",
            "172.67.70.45",
            "35.227.193.242",
            "104.18.11.59",
            "152.236.9.75",
            "172.66.150.162",
            "172.66.171.45"
        ],
        "asns": [
            "15169",
            "13335",
            "396982",
            "396356"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "www.pendle.finance",
            "boros.pendle.finance",
            "app.pendle.finance",
            "medium.com",
            "github.com",
            "t.me",
            "www.coingecko.com",
            "defillama.com",
            "app.sentio.xyz",
            "tokenterminal.com",
            "docs.pendle.finance",
            "x.com",
            "pendle.finance"
        ],
        "social": [
            "https://medium.com/pendle",
            "https://github.com/pendle-finance/pendle-core-v2-public",
            "https://t.me/pendle_info_bot",
            "https://x.com/pendle_fi"
        ],
        "doc_hash": "c47794660de015ae4bf829cdd3eaffc70d1adf2507a89947459051a4aa22e55b",
        "script_hashes": [
            "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c"
        ],
        "globals": [
            "requestResize",
            "selectDate",
            "submitVote",
            "closeConfirm",
            "__earlyClickAction",
            "__removeEarlyClick",
            "Cap",
            "downloadLogsBlobInBrowser"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.pendlefoundation.icu",
                "pendlefoundation.icu"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "pendlefoundation.icu",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-27T09:43:12Z",
            "valid_from": "2026-09-28T09:43:13Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 152,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:43Z",
        "uuid": "088321d8-32d0-4675-83d1-f78746961ebd",
        "scanned_at": "2026-09-29T04:35:56Z",
        "final_url": "https://pendlefoundation.icu/",
        "status": 200,
        "history": [
            {
                "url": "https://pendlefoundation.icu/",
                "status": 200
            }
        ],
        "dom_hash": "5336fab5d5b73f2cc61d5638b56af6141e1af9f2d2527c9d79af9ab8a0de12ce",
        "doc_hash": "9ed522b0b978853596ec81a699b1666dae8d680df91601646d4c08bfa6268d37",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "pendlefoundation.icu",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "pendlefoundation.icu",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "pendlefoundation.icu",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "pendlefoundation.icu",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "whois": {
            "registrar": "Eranet International Limited",
            "created": "2026-09-28T10:31:06Z",
            "updated": "2026-09-28T10:31:08Z",
            "expires": "2027-09-28T23:59:59Z",
            "nameservers": [
                "dahlia.ns.cloudflare.com",
                "gordon.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:43:50Z",
        "analysis_at": "2026-10-14T06:52:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 6,
            "suspicious": 2,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "Lionic": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "suspicious",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "ERANET INTERNATIONAL LIMITED",
        "created": "2026-09-28T18:31:07Z",
        "expires": "2027-09-28T23:59:59Z",
        "updated": "2026-09-28T10:31:08Z",
        "first_seen": "2026-09-28T11:01:27Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "gordon.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c543"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:3453"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.52.83"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.197.67"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dahlia.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dahlia.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-09-29T15:34:10Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.pendlefoundation.icu",
                "pendlefoundation.icu"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6e13f916ccddedcc74edec616e59c865ad7",
            "sha256": "431c648821a85c12f4a2a4e32aef84f98d1d6f92f88a0bb6e8e789c33df72bfb",
            "subject": "pendlefoundation.icu",
            "valid_to": "2026-12-27T09:43:12Z",
            "valid_from": "2026-09-28T09:43:13Z"
        },
        "whois": {
            "registrar": "ERANET INTERNATIONAL LIMITED",
            "registrar_iana_id": "1868",
            "registrar_url": "http://www.eranet.com",
            "created": "2026-09-28T10:31:06Z",
            "updated": "2026-09-28T00:00:00Z",
            "expires": "2027-09-28T00:00:00Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "dahlia.ns.cloudflare.com",
                "gordon.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```