# PhishDestroy domain threat record: staking-pendle.icu

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/staking-pendle.icu/
Machine-readable companion: https://phishdestroy.io/domain/staking-pendle.icu/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 04:38:52 UTC
- Last availability or vendor check: 2026-10-21 01:17:12 UTC
- Stored record updated: 2026-10-22 14:24:24 UTC
- VirusTotal detections in the stored snapshot: 2/91
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Pendle

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Eranet International Limited
- Registrar country in stored WHOIS data: US
- Registration date (registry RDAP, staking-pendle.icu): 2026-09-28 13:06:01 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eb7d-594f-748e-af3e-b6a29b2f2e63/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/staking-pendle.icu
- Certificate Transparency search: https://crt.sh/?q=%25.staking-pendle.icu
- Web Archive lookup: https://web.archive.org/web/*/https://staking-pendle.icu/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
staking-pendle.icu was a phishing page that impersonated Pendle, the DeFi yield-trading protocol. It copied the real site's tagline in its page title, "Pendle - Liberating Yield", and the domain name promised a staking feature to Pendle users and yield farmers. PhishDestroy first detected it on 2026-09-29. It has been offline since 2026-09-30, and on 2026-10-19 its DNS was still inactive.

How the scam works
Pages like this rely on two things a user recognises: the brand and a reward. Here that meant Pendle's own slogan and a "staking" offer that suggests extra yield on tokens the visitor already holds. A visitor is usually asked to connect a wallet and approve a transaction presented as a deposit or staking step. That signature can grant spending permission over the visitor's tokens or send assets directly to the operator. Losses happen on-chain and cannot be reversed.

Evidence
On 2026-09-29, only 2 of 91 VirusTotal engines flagged the domain: alphaMountain.ai and Forcepoint ThreatSeeker. That low count is typical of a page caught within a day of going live, before most vendors had reviewed it. Stronger support comes from crypto-focused blocklists. MetaMask and SEAL list the domain alongside PhishDestroy, so wallet users protected by those lists would have seen a warning.

Infrastructure
The domain was registered through Eranet International Limited on 2026-09-28, one day before PhishDestroy detected it. It was dead two days after registration. This short lifespan matches a disposable phishing domain built to catch traffic quickly before blocklists respond. The site sat behind Cloudflare, on an address geolocated to Canada, which hid the origin server. It used a free Let's Encrypt certificate, so the padlock in the browser showed only that the connection was encrypted, not that the site was legitimate.

What to do
If you connected a wallet to this site and signed anything, use a token-approval checker to review and revoke any approvals you granted around 2026-09-29. If tokens have already moved or you are unsure what you signed, transfer your remaining assets to a new wallet. Never share your seed phrase. Pendle will never ask for it, and any site that does is a scam. Defenders should keep blocking the domain despite its inactive DNS, because phishing domains are often revived. They should also watch for new lookalike domains that combine "staking" or "stake" with "pendle".

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb7d-594f-748e-af3e-b6a29b2f2e63/
VirusTotal report: https://www.virustotal.com/gui/domain/staking-pendle.icu
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=staking-pendle.icu
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:21 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png
  Captured: 2026-09-29 04:49:17 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb7d-594f-748e-af3e-b6a29b2f2e63.png
  Captured: 2026-09-29 04:49:17 UTC
  Source report: https://urlscan.io/result/01a0eb7d-594f-748e-af3e-b6a29b2f2e63/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e83a-8483-75fd-b382-2353602d2fcb.png
  Captured: 2026-09-29 04:38:52 UTC
  Source report: https://urlscan.io/result/01a0eb7d-594f-748e-af3e-b6a29b2f2e63/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1c8f28d7-2f4b-455d-936a-622ad8f1969f.png
  Captured: 2026-09-29 04:43:01 UTC
  Source report: https://radar.cloudflare.com/scan/1c8f28d7-2f4b-455d-936a-622ad8f1969f
  SHA-256: a9de55392111178117306cf8f0feafda7581251e0d10d3d6153e875bef535c8a
- URLQuery: https://screenshots.phishdestroy.io/uq/0721b40f-7494-427f-98f0-d1b52fe9204b.png
  Source report: https://urlquery.net/report/0721b40f-7494-427f-98f0-d1b52fe9204b
  SHA-256: b52acbcd4829131f792669d92017580946818b44dbf2f1c7792fdfd103be0cce
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e83a-8483-75fd-b382-2353602d2fcb.png
  Captured: 2026-09-28 13:35:57 UTC
  Source report: https://urlscan.io/result/01a0e83a-8483-75fd-b382-2353602d2fcb/
  SHA-256: 1adb9632231b815cc9fcf23721b430f38b958326764509195c946c142a9bb4ed
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e83a-7f95-743d-96bf-bb21ec9bb0cd.png
  Captured: 2026-09-28 13:35:57 UTC
  Source report: https://urlscan.io/result/01a0e83a-7f95-743d-96bf-bb21ec9bb0cd/
  SHA-256: 7d6dfb5ec26f0ebbf7493d84122a73153e78c12d92891af24d46cb94e609fc92
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb87-9d10-70a1-97c5-2e0eb185cbaa.png
  Captured: 2026-09-29 04:58:59 UTC
  Source report: https://urlscan.io/result/01a0eb87-9d10-70a1-97c5-2e0eb185cbaa/
  SHA-256: 5d71d886d202aff5a45c4ef301dd5220d285004f218d1ec3f30b344082dbf903

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:54:46Z",
        "uuid": "01a0eb7d-594f-748e-af3e-b6a29b2f2e63",
        "scanned_at": "2026-09-29T04:47:48Z",
        "final_url": "https://staking-pendle.icu/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://staking-pendle.icu/",
                "from": "http://staking-pendle.icu/",
                "status": 307
            }
        ],
        "ip": "104.21.82.77",
        "domains": [
            "gateway.irys.xyz",
            "esm.sh",
            "arbitrum.meowrpc.com",
            "arbitrum.gateway.tenderly.co",
            "arbitrum.drpc.org",
            "rpc.ankr.com",
            "arbitrum-one.publicnode.com",
            "arb1.arbitrum.io",
            "fonts.gstatic.com",
            "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com",
            "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com",
            "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com",
            "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com",
            "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com",
            "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com",
            "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com",
            "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com",
            "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com",
            "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com",
            "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com",
            "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com",
            "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com",
            "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com",
            "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com",
            "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com",
            "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com",
            "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com",
            "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com",
            "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com",
            "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com"
        ],
        "ips": [
            "142.251.163.94",
            "104.21.15.158",
            "172.67.163.26",
            "104.20.31.170",
            "173.194.204.95",
            "104.26.13.205",
            "104.26.14.209",
            "104.17.208.5",
            "172.67.178.73",
            "104.26.11.181",
            "35.227.193.242",
            "104.18.10.59",
            "198.178.224.35",
            "104.20.24.117",
            "104.20.39.96"
        ],
        "asns": [
            "15169",
            "13335",
            "396982",
            "396356"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.pendle.finance",
            "boros.pendle.finance",
            "app.pendle.finance",
            "medium.com",
            "github.com",
            "t.me",
            "www.coingecko.com",
            "defillama.com",
            "app.sentio.xyz",
            "tokenterminal.com",
            "docs.pendle.finance",
            "x.com",
            "pendle.finance"
        ],
        "social": [
            "https://medium.com/pendle",
            "https://github.com/pendle-finance/pendle-core-v2-public",
            "https://t.me/pendle_info_bot",
            "https://x.com/pendle_fi"
        ],
        "doc_hash": "9a6dc3032c991c276f7336335eceb5360e2834d6cee47b26abaf1cca9d9994b1",
        "script_hashes": [
            "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c"
        ],
        "globals": [
            "requestResize",
            "selectDate",
            "submitVote",
            "closeConfirm",
            "__earlyClickAction",
            "__removeEarlyClick",
            "__cfBeacon",
            "Cap",
            "downloadLogsBlobInBrowser"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.staking-pendle.icu",
                "staking-pendle.icu"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "staking-pendle.icu",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-27T12:14:54Z",
            "valid_from": "2026-09-28T12:14:55Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 170,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:35Z",
        "uuid": "1c8f28d7-2f4b-455d-936a-622ad8f1969f",
        "scanned_at": "2026-09-29T04:43:01Z",
        "final_url": "https://staking-pendle.icu/",
        "status": 200,
        "history": [
            {
                "url": "https://staking-pendle.icu/",
                "status": 200
            }
        ],
        "dom_hash": "5336fab5d5b73f2cc61d5638b56af6141e1af9f2d2527c9d79af9ab8a0de12ce",
        "doc_hash": "9a6dc3032c991c276f7336335eceb5360e2834d6cee47b26abaf1cca9d9994b1",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "staking-pendle.icu",
                "type": "A",
                "value": "172.67.198.92"
            },
            {
                "name": "staking-pendle.icu",
                "type": "A",
                "value": "104.21.82.77"
            },
            {
                "name": "staking-pendle.icu",
                "type": "AAAA",
                "value": "2606:4700:3034::6815:524d"
            },
            {
                "name": "staking-pendle.icu",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:c65c"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.198.92",
        "whois": {
            "registrar": "Eranet International Limited",
            "created": "2026-09-28T13:06:01Z",
            "updated": "2026-09-28T13:06:03Z",
            "expires": "2027-09-28T23:59:59Z",
            "nameservers": [
                "adam.ns.cloudflare.com",
                "selah.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:43:34Z",
        "analysis_at": "2026-10-14T06:46:58Z",
        "stats": {
            "timeout": 0,
            "harmless": 48,
            "malicious": 8,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "Ermes": "not recommended",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "suspicious",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "ERANET INTERNATIONAL LIMITED",
        "created": "2026-09-28T21:06:02Z",
        "expires": "2027-09-28T23:59:59Z",
        "updated": "2026-09-28T13:06:03Z",
        "first_seen": "2026-09-28T13:35:57Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.82.77"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "adam.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.198.92"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "selah.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "adam.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:524d"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:c65c"
            }
        ],
        "dns_at": "2026-09-29T17:23:29Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.staking-pendle.icu",
                "staking-pendle.icu"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6a797f9df2bdfa9ea11c40edc8a93fdf77b",
            "sha256": "cd82f50a74971c7183877ae8b98ea283847415baa896ff849c9614eb74397beb",
            "subject": "staking-pendle.icu",
            "valid_to": "2026-12-27T12:14:54Z",
            "valid_from": "2026-09-28T12:14:55Z"
        },
        "whois": {
            "registrar": "ERANET INTERNATIONAL LIMITED",
            "registrar_iana_id": "1868",
            "registrar_url": "http://www.eranet.com",
            "created": "2026-09-28T13:06:01Z",
            "updated": "2026-09-28T00:00:00Z",
            "expires": "2027-09-28T00:00:00Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "adam.ns.cloudflare.com",
                "selah.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```