app-boros-pendle[.]finance

Analysis of app-boros-pendle.finance indicates that the domain was registered on July 24, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted on the IP address 188.114.96.3. The authoritative name servers are kip.ns.cloudflare.com and meera.ns.cloudflare.com, both belonging to Cloudflare’s DNS network, which is frequently used by both legitimate services and malicious operators to obscure infrastructure. The domain remains active as of the report date and is listed on a single security blocklist. VirusTotal scanning shows that one out of ninety‑one anti‑malware engines flagged the domain, suggesting at least one vendor has identified malicious behavior associated with it. PhishDestroy also reports the domain as blocked, reinforcing the classification as a phishing vector.

The limited detection surface—only one blocklist entry and a single vendor flag—means that broader community awareness of the threat is still emerging. No additional intelligence such as Safe Browsing status, Open Threat Exchange reports, SSL certificate details, or HTTP response codes is available, leaving the full scope of the hosting environment and potential payload delivery mechanisms uncertain. The use of Cloudflare name servers does not, by itself, confirm malicious intent, but combined with the registrar information, the active status, and the existing blocklist entries, the risk profile aligns with a high‑confidence phishing indicator. Defenders should add app-boros-pendle.finance to URL filtering rules and blocklist it at perimeter and endpoint layers.

Network monitoring should include alerts for DNS queries to the two Cloudflare name servers that resolve to 188.114.96.3, and any outbound connections to that IP should be inspected or denied pending further investigation. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is recommended to capture any escalation in detection counts.