rocketpool-onchain[.]pages[.]dev

The domain rocketpool-onchain.pages.dev was registered on March 23, 2026 through Cloudflare, Inc. and is served by the Cloudflare nameservers jacob.ns.cloudflare.com and summer.ns.cloudflare.com. DNS resolution points to IP address 172.66.45.22, which is hosted in the Cloudflare network in Canada. The site presents a TLS certificate issued by Google Trust Services under the WE1 identifier, confirming the use of HTTPS. An HTTP request to the root URL returns a 403 status code, indicating that the server is actively denying access to the page content.

The page title observed in the limited metadata is "Migrate RPL - Rocket Pool," linking the site to the Rocket Pool brand and confirming a brand‑impersonation intent. Automated analysis detects the presence of Vue.js, HTTP/3, HSTS enforcement, and Cloudflare as the underlying web technology stack. VirusTotal scans record three positive detections out of ninety‑four vendors, and the domain is listed on two independent blocklists, PhishDestroy and ScamSniffer.

Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The domain is currently offline, and no further content was captured during the investigation. Defenders should block the domain and its associated IP address at perimeter and DNS filters, monitor for any re‑hosting of the same certificate or page title, and incorporate the observed indicators—creation date, registrar, nameservers, IP, TLS certificate details, and blocklist entries—into threat‑intel feeds to improve detection of related campaigns.