rpchubsolutions[.]pages[.]dev

PhishDestroy identifies rpchubsolutions.pages.dev as a crypto drainer domain actively distributing malicious payloads to unsuspecting users. This domain mimics RPC Hub Solutions to deceive victims into connecting crypto wallets or entering seed phrases, resulting in fund theft. The threat operator leverages Cloudflare’s infrastructure and Google Trust Services certificates to appear legitimate, while hosting the drainer on IP 188.114.97.3. Analysis shows zero detections across 95 VirusTotal scanners, underscoring its stealthy nature and the need for proactive blocking. This domain was flagged through Cloudflare with registration details obscured, though the resolver points to ASN 13335 (Cloudflare, Inc.). VirusTotal scans returned 6/95 detections as of the last update, indicating no AV or sandbox signatures yet associate with the payload. The domain remains active and continues to evade automated detection systems, posing a significant risk to cryptocurrency users engaging with fake RPC services or wallet integrations. Given its use of a Google-issued SSL certificate and Cloudflare proxy, it bypasses many traditional security filters that rely on domain age or reputational data. Users who visited rpchubsolutions.pages.dev should immediately disconnect any connected crypto wallets, revoke any granted permissions via blockchain explorers or wallet dashboards, and scan devices for malware. Do not interact with wallet prompts or login forms on this domain. Report the domain to PhishDestroy using the unique seed 286cd0 for further blocking. If funds were lost, file a report with local cybercrime units and the relevant blockchain’s fraud reporting system. Always verify third-party RPC endpoints and wallet integrations against official documentation before use.