rootstock-verify[.]pages[.]dev

This domain, rootstock-verify.pages.dev, is flagged for high-risk brand impersonation, specifically targeting the Bitcoin brand. The domain impersonates the RSK (Rootstock) project, which is associated with Bitcoin, to deceive users into providing sensitive information or engaging in fraudulent transactions. No specific drainer kit was identified, but the site's content and structure suggest a sophisticated attempt to mimic legitimate Bitcoin-related services.

Infrastructure analysis reveals that the domain has a VirusTotal detection score of 17/95, indicating a moderate level of suspicion among security vendors. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.97. It was created on April 27, 2026, and is currently flagged by Google Safe Browsing for social engineering. Additionally, the domain appears on 3 security blocklists, further confirming its malicious nature. The SSL certificate is provided by Google Trust Services, which may be used to gain user trust and avoid detection by less sophisticated security tools.

The domain is currently offline, which suggests that it has been taken down as part of a coordinated response to mitigate the threat. However, the offline status does not eliminate the risk entirely, as the domain could be reactivated at any time. Users are advised to remain vigilant and avoid clicking on links or entering personal information on any unfamiliar Bitcoin-related websites. Security teams should monitor for any signs of the domain coming back online and ensure that necessary protections are in place to prevent user exposure.