rathbun[.]pages[.]dev

The domain rathbun.pages.dev has been confirmed as an active phishing site specializing in brand impersonation, specifically targeting users of the Revolut financial platform. Analysis of the page title, 'MJ Rathbun | Airdrop,' and associated infrastructure indicates an intent to deceive victims into engaging with fraudulent airdrop or reward schemes under the guise of legitimate Revolut services. The domain remains operational as of the latest verification, posing a high risk to unsuspecting users. Technical indicators reveal that rathbun.pages.dev is flagged by 7 out of 95 security vendors on VirusTotal, a detection ratio that underscores its malicious nature. The domain was registered through Cloudflare, Inc. on February 13, 2026, and resolves to the IP address 188.114.97.3, which is associated with AS13335 (Cloudflare, Inc.) in the United States. The site appears on four distinct security blocklists and is actively blocked by multiple threat intelligence platforms. The SSL certificate is issued by Google Trust Services (WE1), a common but not exclusive indicator of legitimacy, often exploited by threat actors to lend credibility to phishing pages. Current status confirms that rathbun.pages.dev remains active, continuing to host fraudulent content designed to harvest sensitive information or deploy malicious payloads. Organizations and individuals are advised to implement immediate blocking measures for this domain and its associated IP address. Users who may have interacted with the site should revoke any connected sessions, reset credentials for Revolut or other financial accounts, and monitor for unauthorized transactions. Proactive monitoring of related infrastructure, including domains registered through the same registrar or resolving to the same IP range, is recommended to mitigate further exposure.