claiming-pendle[.]net

The domain claiming-pendle.net was registered on 20 November 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to 172.67.204.42, an address owned by AS13335 Cloudflare, Inc. in the United States. The site serves a TLS certificate issued by Google Trust Services under the WE1 branch, and its authoritative name servers are duke.ns.cloudflare.com and meilani.ns.cloudflare.com. Detected technologies include Cloudflare Browser Insights, Cloudflare edge services, and HTTP/3 support. The page title returned by the server is “Nur einen Moment…”, and the HTTP response code is 403.

The infrastructure signals a high‑confidence brand‑impersonation campaign targeting the cryptocurrency platform Pendle. The domain is currently listed on two security blocklists—PhishDestroy and ScamSniffer—and receives a Gridinsoft trust score of 0 out of 100. VirusTotal analysis shows that 2 of 95 scanned security vendors flag the domain, reinforcing the malicious assessment. The combination of a low trust score, blocklist presence, and the explicit “cryptocurrency” scam type suggests an intent to deceive users into financial loss, likely through fraudulent token or wallet interactions. No visual content has been observed, and the exact phishing payload remains unknown.

Defenders should prioritize immediate containment of the host by adding claiming-pendle.net and its resolved IP address to outbound and inbound deny lists across network perimeters and endpoint protection solutions. Monitoring for DNS queries to the domain and for TLS connections to the associated Cloudflare certificate can provide early warning of attempted abuse. Security teams are advised to incorporate the observed blocklist identifiers and the low Gridinsoft score into threat‑intel feeds to improve detection accuracy. Continuous re‑assessment is recommended, as additional indicators—such as payload delivery mechanisms or compromised accounts—may emerge if the site becomes publicly accessible.