borosfi-pendle[.]finance

Analysis of borosfi-pendle.finance indicates that the domain was registered on July 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IP address 104.21.51.49. The domain is hosted on Cloudflare DNS, as evidenced by the authoritative nameservers kip.ns.cloudflare.com and meera.ns.cloudflare.com. The same IP is associated with a Cloudflare edge node, which is commonly used by malicious actors to hide origin infrastructure. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one threat‑intelligence feed has classified it as malicious.

VirusTotal data shows that one out of ninety‑five scanning engines has flagged the domain, providing independent corroboration of malicious intent. The overall risk rating has been assigned as high, and the status is listed as active, meaning the site is still reachable. No public information about the site’s page title, SSL certificate details, or HTTP response code has been disclosed, so the exact content and any credential‑harvesting mechanisms remain unknown. Likewise, the lack of additional blocklist entries or broader vendor detections limits the visibility into the campaign’s scale, but the presence on a reputable phishing‑specific blocklist and the single vendor detection suggest a targeted phishing operation that is in early stages.

Defenders should block DNS resolution to 104.21.51.49 for the domain borosfi-pendle.finance at the network perimeter and add the fully qualified domain name to web‑filtering and URL‑allowance policies. Monitoring of outbound traffic for connections to the Cloudflare‑served IP is advised, as is the inclusion of the domain in threat‑intel feeds and SIEM correlation rules. Because the registrar is known, future domains registered by NICENIC INTERNATIONAL GROUP CO., LIMITED may warrant additional scrutiny.