pendle[.]fi-markets[.]net

On 14 April 2025 the domain pendle.fi-markets.net was registered through NiceNIC International Group Co., Limited. The domain resolves to the IP address 198.18.0.54 and is served via Cloudflare, using HTTP/3 and presenting a Google Trust Services / WE1 SSL certificate. The page title returned by the server is “www.pendle.fi-markets.net”. According to the provided intelligence the site was used to promote an investment‑scam campaign that impersonates the cryptocurrency protocol Pendle. VirusTotal scans show that two of ninety‑five security vendors flagged the domain as malicious, and the domain appears on a single security blocklist. It has been added to the PhishDestroy blocklist and is currently taken offline.

Nameserver records point to audrey.ns.cloudflare.com and augustus.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. Analysis indicates that the combination of a recent registration date, the use of a reputable CDN, a valid SSL certificate, and minimal detection coverage is consistent with a “low‑and‑slow” brand‑impersonation infrastructure designed to evade rapid takedown. The limited number of detections suggests that the malicious payload, if any, was either short‑lived or not yet widely distributed. The exact content of the hosted page has not been captured, so the specific tactics remain unknown. At present no evidence links the domain to additional command‑and‑control servers or to known phishing kits, and no public abuse reports have been filed beyond the blocklist entry.

Given the elevated risk rating, security teams should treat any traffic to the domain as malicious until a thorough forensic capture confirms otherwise. Defenders should add pendle.fi-markets.net to local blocklists and deny outbound connections to 198.18.0.54. Monitoring for future registrations that reuse the same registrar, Cloudflare nameservers, or similar SSL certificate fingerprints may reveal follow‑up campaigns.