pendle-airdrop[.]app

PhishDestroy has identified pendle-airdrop.app as a brand impersonation threat targeting Pendle users with a crypto drainer scheme, and the domain carries an elevated risk level. This fraudulent site mimics the legitimate Pendle platform to trick visitors into connecting their cryptocurrency wallets or entering sensitive information, ultimately aiming to drain assets. The domain was registered on April 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 104.21.82.176, with an SSL certificate issued by Let's Encrypt (E7) providing a false sense of security.

VirusTotal analysis shows that 3 out of 95 security vendors flag this domain as malicious, and it appears on three independent security blocklists. AlienVault OTX has recorded the domain in one threat intelligence pulse, underscoring its malicious reputation. Despite the domain currently being taken offline, the underlying infrastructure and tactics remain a concern, as similar domains may reappear. The combination of a newly registered domain, brand impersonation, and wallet-draining intent makes this a clear phishing campaign.

To protect against such threats, users should always verify the official Pendle URL (pendle.finance) and never connect wallets or provide private keys to unknown sites. Enable two-factor authentication on all crypto accounts, use hardware wallets for large holdings, and rely on browser extensions that block known phishing domains. If you have interacted with pendle-airdrop.app, immediately revoke any token approvals, transfer funds to a new wallet, and monitor for suspicious activity. Reporting the domain to security platforms and the Pendle team helps prevent future attacks.