rocket-pool[.]hpage[.]com

rocket-pool.hpage.com is an active brand impersonation phishing domain specifically targeting users of the Rocket Pool cryptocurrency staking platform. The site presents itself as the official Rocket Pool homepage with the title 'Rocket Pool™ | Home Official Site' but is a fraudulent attempt to steal login credentials or private keys from visitors. The domain has been taken offline, but it posed an elevated risk due to its convincing appearance and use of legitimate-looking infrastructure.

Technical analysis reveals that rocket-pool.hpage.com is flagged by 1 of 95 VirusTotal vendors, including Gridinsoft, which assigned it a trust score of 0/100. The domain was registered on February 21, 2026, through Mesh Digital Limited and resolves to IP address 2001:1bc0:ad::d100, hosted in Germany on AS29686 (Jonas Frey trading as Probe Networks). It appears on one security blocklist, PhishDestroy, and uses an SSL certificate issued by Sectigo Limited. The site employs Nginx and OpenResty technologies, along with jQuery and HSTS, but no drainer kit was detected. Nameservers are ns1.nodesecure.com and ns2.nodesecure.de.

Users who interacted with rocket-pool.hpage.com should immediately change any passwords entered on the site and enable two-factor authentication on their Rocket Pool accounts and associated email. Since this is a credential phishing attack rather than a crypto drainer, no token approvals need revocation, but users should monitor their accounts for unauthorized activity. Report the domain to Google Safe Browsing and the Rocket Pool security team, and consider submitting a complaint to the registrar Mesh Digital Limited.