stx-rpcdebug[.]pages[.]dev

This domain, stx-rpcdebug.pages.dev, is currently flagged as an active cryptocurrency wallet phishing site targeting users of the Linkup Affixs wallet service. Analysis indicates the page title, 'Wallets | Linkup Affixs,' is designed to deceive victims into believing they are interacting with a legitimate wallet interface, likely to harvest sensitive credentials such as private keys or recovery phrases. The domain remains operational and poses a high risk to users unaware of the impersonation attempt. Infrastructure analysis reveals the domain was registered on June 30, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.134, which is geolocated to California and associated with Cloudflare’s content delivery network. Despite its recent creation, the domain has already been flagged by one security blocklist and identified as phishing by Google Safe Browsing. VirusTotal reports zero detections out of 95 vendors, indicating the threat may still be under the radar for many security solutions. The SSL certificate is issued by Google Trust Services under the WE1 root, a common practice for legitimate and malicious domains alike, which does not mitigate the risk posed by this site. Current status confirms the domain remains active and accessible, with no takedown actions observed as of this assessment. Users are strongly advised to avoid interacting with stx-rpcdebug.pages.dev and any associated links. Organizations should block the domain and its resolving IP at the network level, while wallet providers should monitor for similar impersonation attempts targeting their brand. Individuals who may have entered credentials on this site should immediately transfer assets to a secure wallet and revoke any compromised access. Enhanced monitoring of newly registered domains with similar naming patterns is recommended to detect emerging threats.