rpchubfix[.]pages[.]dev

The domain rpchubfix.pages.dev is flagged as a credential‑phishing site targeting cryptocurrency users. Infrastructure analysis shows the domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS is served by Cloudflare’s authoritative name servers max.ns.cloudflare.com and norah.ns.cloudflare.com, indicating the operator is leveraging Cloudflare’s CDN and protection services. The site presents a valid SSL certificate issued by Google Trust Services / WE1, confirming that TLS termination is performed by Cloudflare’s edge.

HTTP headers reveal the use of HSTS and HTTP/3, both typical of modern Cloudflare‑hosted sites. An HTTP request returns a 403 status, and the domain is currently taken offline, which limits direct content inspection. The page title “RPC Recovery Hub – We are here to help you resolve your crypto related issues” aligns with the credential‑phishing classification and suggests a social‑engineering lure aimed at crypto‑wallet owners. Threat intelligence indicates the domain appears on five security blocklists (PhishDestroy, ScamSniffer, Polkadot, Enkrypt, Codeesura) and has been flagged by five of ninety‑three VirusTotal scanners, reinforcing the malicious assessment.

Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of abuse. While the 403 response prevents verification of any malicious payload or credential‑harvesting form, the combination of blocklist listings, low trust score, and the targeted page title provides concrete evidence of phishing intent. Defenders should immediately block rpchubfix.pages.dev at the DNS and proxy layers, add the domain to web‑filter allowlists as a malicious entry, and monitor for any future re‑hosting of the same content on alternative IPs or subdomains.