qweqwe-e4t[.]pages[.]dev

On July 24, 2026, the domain qweqwe-e4t.pages.dev was observed to host a page titled “Renzo Protocol - Liquid Restaking”. The page title, together with the explicit “Impersonates: renzo” flag, indicates a brand impersonation campaign targeting the Renzo brand. The domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the Cloudflare edge address 172.66.46.254, which is associated with AS13335 (Cloudflare, Inc.) located in the United States. DNS resolution uses the nameservers dave.ns.cloudflare.com and carol.ns.cloudflare.com, both typical of Cloudflare‑provided services. Security telemetry shows the domain is listed on one blocklist and has been actively blocked by the PhishDestroy service.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal analysis recorded five detections out of ninety‑three scanners, confirming that multiple security engines flag the site as malicious. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 identifier, and the server advertises HTTP Strict Transport Security (HSTS) as well as support for HTTP/3, consistent with Cloudflare’s default configuration. An HTTP request to the site returns a 403 Forbidden status, suggesting that the content is either restricted or the hosting has been taken offline.

The current “Status” field lists the domain as offline, indicating that the malicious page is no longer reachable at the time of analysis. Given the available evidence, the primary indicators of compromise are the brand‑specific page title, the low trust score, blocklist presence, and the multiple VirusTotal detections. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS threat feeds to include qweqwe-e4t.pages.dev, and monitor for any re‑registration of similar subdomains under the same registrar.