stake-rocketpool-net[.]pages[.]dev

This domain presents itself as an official Across staking portal under the false identity of Rocket Pool, a tactic used to deceive users into submitting wallet credentials or transferring cryptocurrency. The site mimics legitimate staking interfaces, likely prompting visitors to connect wallets or enter seed phrases, which would grant attackers direct access to funds. Such impersonation schemes often exploit brand recognition to bypass user skepticism, particularly in decentralized finance environments where trust is critical. Analysis indicates the domain was registered on June 29, 2024, through Cloudflare’s registrar infrastructure. It is flagged by 11 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. The site resolved to 172.66.47.53, a Cloudflare IP address, and appeared on two security blocklists prior to being taken offline. The SSL certificate, issued by Google Trust Services, does not mitigate the malicious intent, as attackers commonly use valid certificates to appear legitimate. Users who visited stake-rocketpool-net.pages.dev should immediately revoke any wallet permissions granted to the site and monitor connected accounts for unauthorized transactions. If credentials or seed phrases were entered, affected wallets should be considered compromised; transfer remaining assets to a new, secure wallet. Enable multi-factor authentication on all related accounts and review recent transaction histories for anomalies. Report the incident to relevant security teams or platforms to aid in broader threat mitigation efforts.