pendle-finance[.]at

The domain pendle-finance.at was registered on March 11, 2026 and is currently listed as offline. Infrastructure analysis shows the domain resolves to IP 172.67.221.115, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are arushi.ns.cloudflare.com and wilson.ns.cloudflare.com, confirming that the site is hosted behind Cloudflare's edge network. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration despite the malicious intent.

An HTTP request returns a 403 status code, suggesting that the site is deliberately denying access, which is consistent with a takedown or temporary suspension. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, all of which classify it as a crypto‑related brand impersonation targeting Pendle. VirusTotal records show that two of ninety‑four scanning engines flagged the domain, providing additional vendor corroboration. AlienVault OTX lists the domain in twenty‑three threat intelligence pulses, reinforcing its association with known malicious campaigns.

The page title "Pendle Finance Platform 2026 - DeFi Trading Protocol" aligns with the declared scam type of a crypto scam and the brand target Pendle, indicating deliberate brand misuse. Defenders should immediately block pendle-finance.at at the DNS and proxy layers, flag any outbound connections to its Cloudflare IP, and monitor for re‑registration or similar domains that mimic Pendle. Continuous observation of the listed blocklists and OTX pulses is recommended to capture any resurgence of the threat.