u5u4u45u45[.]pages[.]dev

The domain u5u4u45u45.pages.dev was registered on March 23, 2026 and resolves to the Cloudflare address 172.66.47.145, hosted in the Cloudflare, Inc. network in CA. TLS is provided by Google Trust Services under the WE1 certificate, and the site enforces HSTS while supporting HTTP/3. An HTTP request returns a 403 status, indicating the site is currently taken offline. Front‑end analysis shows the presence of Vue.js, suggesting a modern web‑application framework typical of many phishing kits.

The page title is "Pendle", matching the declared brand target, and the scam type is listed as brand impersonation, confirming that the domain was intended to masquerade as an official Pendle resource. Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, ScamAdviser rates the domain at 11 / 100, and three independent blocklists—PhishDestroy, ScamSniffer and Enkrypt—have already listed the domain. VirusTotal scans report that seven of ninety‑four security vendors flag the domain as malicious, reinforcing the suspicion despite the current offline state.

The registrar information shows Cloudflare, Inc. as the registrar, and the nameservers alex.ns.cloudflare.com and kinsley.ns.cloudflare.com are in use. Defenders should immediately add u5u4u45u45.pages.dev to DNS blocklists and firewall deny lists, enforce URL filtering for the "Pendle" keyword to catch any residual redirects, and monitor for re‑registration or similar sub‑domain patterns on the same Cloudflare edge. Continuous threat‑intel feeds should be queried for any resurgence, and security teams are advised to share this indicator set with incident response platforms to improve collective detection of Pendle‑related brand‑impersonation campaigns.