# PhishDestroy domain threat record: staking-pendle.top Content language: English Canonical HTML report: https://phishdestroy.io/domain/staking-pendle.top/ Machine-readable companion: https://phishdestroy.io/domain/staking-pendle.top/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-29 04:57:57 UTC - Last availability or vendor check: 2026-10-21 22:32:53 UTC - Stored record updated: 2026-10-22 14:24:24 UTC - VirusTotal detections in the stored snapshot: 5/91 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: Pendle ## Stored infrastructure - Observed IP address: 104.21.61.222 - Registrar in stored WHOIS data: Eranet International Limited - Registrar country in stored WHOIS data: US - Registration date (registry RDAP, staking-pendle.top): 2026-09-28 13:06:14 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0eb85-612f-77d9-8ce3-81e2ad202e37/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/staking-pendle.top - Certificate Transparency search: https://crt.sh/?q=%25.staking-pendle.top - Web Archive lookup: https://web.archive.org/web/*/https://staking-pendle.top/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview staking-pendle.top is an impersonation phishing page posing as Pendle, the DeFi yield-trading protocol. It used Pendle's own tagline, "Pendle - Liberating Yield", as its page title, and the domain name suggests a staking offer aimed at Pendle users and yield seekers. PhishDestroy first flagged it on 2026-09-29. The site has been offline since 2026-09-30 and was still dead when last checked on 2026-10-19. How the scam works Fake staking pages like this copy the look and wording of the real protocol, then ask the visitor to connect a wallet to claim rewards or start staking. The "stake" is usually a malicious transaction or a token approval that hands the attacker control over the victim's assets. One signature can be enough to drain approved tokens, and on-chain transfers cannot be reversed. Evidence Five of 91 VirusTotal engines flagged the domain on 2026-09-29: Ermes, Forcepoint ThreatSeeker, Fortinet, Lionic and SOCRadar. That count is modest, which is common for a page that was caught and went dark within days. Stronger signals come from elsewhere. Google Safe Browsing labels it SOCIAL_ENGINEERING, and MetaMask and SEAL list it alongside PhishDestroy, so wallet users were warned at the point of connection. Four AlienVault OTX pulses reference it as well. Infrastructure The domain was registered through Eranet International Limited on 2026-09-28, one day before PhishDestroy detected it. That short gap points to a disposable domain built for a quick campaign. It sat behind Cloudflare (104.21.61.222, geolocated to CA), which hides the true origin server. A free Let's Encrypt certificate gave it the browser padlock, which proves nothing about who runs a site. What to do If you connected a wallet to staking-pendle.top, open a token-approval checker and revoke any approvals or permits granted around the time you visited. If you signed anything, move your remaining funds to a fresh wallet. If you entered a seed phrase, treat that wallet as fully compromised and empty it immediately. Reach Pendle only through its official channels, and be wary of any "staking" link that arrives through ads, replies or direct messages. Defenders should block the domain and watch for lookalike staking-themed domains on cheap TLDs that reuse Pendle branding. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb85-612f-77d9-8ce3-81e2ad202e37/ VirusTotal report: https://www.virustotal.com/gui/domain/staking-pendle.top Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=staking-pendle.top Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:15:09 UTC ## Stored page captures - Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png Captured: 2026-09-29 04:57:57 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0eb85-612f-77d9-8ce3-81e2ad202e37.png Captured: 2026-09-29 04:57:57 UTC Source report: https://urlscan.io/result/01a0eb85-612f-77d9-8ce3-81e2ad202e37/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6244421b-2a39-4356-8768-13461a31a9bb.png Captured: 2026-09-29 05:30:55 UTC Source report: https://radar.cloudflare.com/scan/6244421b-2a39-4356-8768-13461a31a9bb SHA-256: 38ac28cfd421fa2800073a4cc182c14318d19b6b03c958f0724691878366341b - URLQuery: https://screenshots.phishdestroy.io/uq/55255ad5-8822-4bae-a410-8d5e6431ce1f.png Source report: https://urlquery.net/report/55255ad5-8822-4bae-a410-8d5e6431ce1f SHA-256: 1261a050850bf1438c1f37066a7e5383c284a039766f28200ed2a1426371e446 - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e8bd-f4ab-771a-8cb9-79e7977d9bf4.png Captured: 2026-09-28 15:59:30 UTC Source report: https://urlscan.io/result/01a0e8bd-f4ab-771a-8cb9-79e7977d9bf4/ SHA-256: 559c5c9f77acd0f22cdb621a72a4b47ae58c0686d42bb9dd4c02047240d692f0 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb7f-5ae9-738d-950e-06643e7697c0.png Captured: 2026-09-29 04:49:59 UTC Source report: https://urlscan.io/result/01a0eb7f-5ae9-738d-950e-06643e7697c0/ SHA-256: 856d395fab71c9f2f2d3f0199e3d868d31f3dab42218e3b3ff9ea277d07f105a - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb87-38b5-71a4-9423-d3cee2acde3c.png Captured: 2026-09-29 04:58:35 UTC Source report: https://urlscan.io/result/01a0eb87-38b5-71a4-9423-d3cee2acde3c/ SHA-256: 1133368ae846dd99de1fa7fdab478b5c447e0f881cb31541335cad8f69f3ff51 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T20:54:40Z", "uuid": "01a0eb85-612f-77d9-8ce3-81e2ad202e37", "scanned_at": "2026-09-29T04:56:39Z", "final_url": "https://staking-pendle.top/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://staking-pendle.top/", "from": "http://staking-pendle.top/", "status": 307 } ], "ip": "104.21.61.222", "domains": [ "gateway.irys.xyz", "esm.sh", "arbitrum.meowrpc.com", "arbitrum.gateway.tenderly.co", "arbitrum.drpc.org", "rpc.ankr.com", "arbitrum-one.publicnode.com", "arb1.arbitrum.io", "fonts.gstatic.com", "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com", "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com", "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com", "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com", "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com", "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com", "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com", "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com", "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com", "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com", "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com", "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com", "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com", "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com", "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com", "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com", "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com", "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com", "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com", "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com", "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com" ], "ips": [ "142.251.42.99", "172.67.163.26", "104.20.31.170", "142.250.207.10", "172.67.74.152", "172.67.70.222", "104.17.208.5", "172.67.178.73", "172.67.70.45", "35.227.193.242", "104.18.11.59", "206.223.224.224", "104.20.24.117", "172.66.171.45", "104.16.79.73" ], "asns": [ "15169", "13335", "396982", "396356" ], "countries": [ "US", "SG" ], "link_domains": [ "www.pendle.finance", "boros.pendle.finance", "app.pendle.finance", "medium.com", "github.com", "t.me", "www.coingecko.com", "defillama.com", "app.sentio.xyz", "tokenterminal.com", "docs.pendle.finance", "x.com", "pendle.finance" ], "social": [ "https://medium.com/pendle", "https://github.com/pendle-finance/pendle-core-v2-public", "https://t.me/pendle_info_bot", "https://x.com/pendle_fi" ], "doc_hash": "5fba6c5d9160008432a7f764372532a39ba522d3207f6dad9abada8fc187ef18", "script_hashes": [ "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c" ], "globals": [ "requestResize", "selectDate", "submitVote", "closeConfirm", "__earlyClickAction", "__removeEarlyClick", "__cfBeacon", "Cap", "downloadLogsBlobInBrowser" ], "cookies": [ "PHPSESSID" ], "tls": { "san": [ "*.staking-pendle.top", "staking-pendle.top" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "staking-pendle.top", "protocol": "QUIC", "valid_to": "2026-12-27T12:13:36Z", "valid_from": "2026-09-28T12:13:37Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 154, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T21:03:33Z", "uuid": "6244421b-2a39-4356-8768-13461a31a9bb", "scanned_at": "2026-09-29T05:30:55Z", "final_url": "https://staking-pendle.top/", "status": 200, "history": [ { "url": "https://staking-pendle.top/", "status": 200 } ], "dom_hash": "5336fab5d5b73f2cc61d5638b56af6141e1af9f2d2527c9d79af9ab8a0de12ce", "doc_hash": "5fba6c5d9160008432a7f764372532a39ba522d3207f6dad9abada8fc187ef18", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "staking-pendle.top", "type": "A", "value": "172.67.215.193" }, { "name": "staking-pendle.top", "type": "A", "value": "104.21.61.222" }, { "name": "staking-pendle.top", "type": "AAAA", "value": "2606:4700:3033::6815:3dde" }, { "name": "staking-pendle.top", "type": "AAAA", "value": "2606:4700:3035::ac43:d7c1" } ], "dnssec_valid": false, "ip": "172.67.215.193", "whois": { "registrar": "Eranet International Limited", "created": "2026-09-28T13:06:14Z", "updated": "2026-09-28T13:06:14Z", "expires": "2027-09-28T13:06:14Z", "nameservers": [ "cass.ns.cloudflare.com.", "dion.ns.cloudflare.com." ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T16:42:21Z", "analysis_at": "2026-10-14T10:10:07Z", "stats": { "timeout": 0, "harmless": 48, "malicious": 9, "suspicious": 1, "undetected": 34 }, "detections": { "Ermes": "not recommended", "Lionic": "phishing", "Sophos": "phishing", "Certego": "phishing", "Fortinet": "phishing", "SOCRadar": "phishing", "LevelBlue": "phishing", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "ERANET INTERNATIONAL LIMITED", "created": "2026-09-28T21:06:14Z", "expires": "2027-09-28T13:06:14Z", "updated": "2026-09-28T13:06:14Z", "first_seen": "2026-09-28T16:00:29Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.215.193" }, { "ttl": 300, "type": "A", "value": "104.21.61.222" }, { "ttl": 21600, "type": "NS", "value": "dion.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:d7c1" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:3dde" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "cass.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "cass.ns.cloudflare.com" } ], "dns_at": "2026-09-29T12:47:08Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.staking-pendle.top", "staking-pendle.top" ], "issuer": "Let's Encrypt / YE2", "serial": "60b6806ff66348d657b9f71a1726732592e", "sha256": "57bd71bdbac0d36a8ebdd4bfaeefca50bc7ca7470e9bc0e737eb2a6c301b8ea6", "subject": "staking-pendle.top", "valid_to": "2026-12-27T12:13:36Z", "valid_from": "2026-09-28T12:13:37Z" }, "whois": { "registrar": "ERANET INTERNATIONAL LIMITED", "registrar_iana_id": "1868", "registrar_url": "http://www.eranet.com", "created": "2026-09-28T13:06:14Z", "updated": "2026-09-28T00:00:00Z", "expires": "2027-09-28T00:00:00Z", "status": [ "addPeriod", "clientTransferProhibited" ], "nameservers": [ "cass.ns.cloudflare.com", "dion.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-09-27T16:00:00Z", "last changed": "2026-09-29T16:00:00Z", "registration": "2026-09-28T13:06:14Z", "registrar expiration": "2027-09-27T16:00:00Z", "last update of RDAP database": "2026-10-14T07:04:02Z" } } } } ```