rocket-9q5[.]pages[.]dev

This domain presents a high risk to users, as it has been identified as a brand impersonation threat specifically targeting the Ethereum ecosystem. The site mimics the look and feel of a legitimate decentralized liquid staking protocol, luring visitors into connecting their wallets or providing sensitive information, which leads to asset theft via crypto drainer mechanisms. PhishDestroy warns that interacting with this site could result in immediate loss of funds.

The domain rocket-9q5.pages.dev was created on April 1, 2026, and resolves to IP address 172.66.47.39. It is registered through Cloudflare, Inc., and uses an SSL certificate issued by Google Trust Services / WE1. VirusTotal data shows that only 1 out of 95 security vendors flag this domain as malicious, indicating low detection coverage. Despite this, it appears on at least one security blocklist. The page title is "Decentralised Ethereum Liquid Staking Protocol - Rocket Pool," which is a direct impersonation of the legitimate Rocket Pool platform. These technical indicators collectively suggest a sophisticated phishing campaign that may evade many traditional security tools.

To protect against this threat, users should never connect their cryptocurrency wallets or enter private keys, seed phrases, or passwords on this domain. Always verify the official URL of Rocket Pool (rocketpool.net) and double-check domain names for subtle misspellings or added characters. Enable two-factor authentication on all accounts and use hardware wallets for transactions. Report the domain to browser security vendors and block it at the network level if possible. If you have already interacted with the site, immediately revoke any token approvals and transfer remaining funds to a secure wallet.