renzo[.]protocol-restaking[.]com

Analysis of renzo.protocol-restaking.com shows a newly registered domain (creation date February 21 2026) that is actively serving web content (HTTP 200) and is hosted behind Cloudflare (IP 188.114.97.3, AS13335). The domain is registered through NiceNIC International Group Co., Limited and uses Cloudflare nameservers (april.ns.cloudflare.com, kayden.ns.cloudflare.com). The TLS certificate is issued by Google Trust Services, indicating a valid HTTPS endpoint. The page title advertises a “Secure Crypto Staking & Ethereum Liquid Restaking Platform” and references “Maximize Yields & DeFi Asset Management 2024,” directly targeting the Ethereum brand. This aligns with the declared threat type of brand impersonation and the broader classification of a crypto‑related scam. The site appears on a single security blocklist and is listed by PhishDestroy, confirming that threat‑intel feeds have flagged it. VirusTotal scans show two of ninety‑five security vendors flagging the domain, providing independent corroboration of malicious intent. Infrastructure evidence suggests the operators are leveraging reputable CDN services to obscure origin, a common tactic in financial fraud campaigns. While the content of the landing page has not been examined, the combination of brand‑targeted wording, recent registration, and active blocklist entries indicates a high‑confidence malicious operation. Defenders should block the domain at network perimeters, monitor DNS queries for the domain and its associated IP, and add the host to endpoint allow‑list exclusions. Continuous re‑evaluation is advised as additional telemetry (e.g., phishing kit signatures or observed payloads) becomes available.