www-rocketpool[.]pages[.]dev

PhishDestroy identifies an active brand impersonation campaign targeting Rocket Pool users via the domain www-rocketpool.pages.dev. This malicious site mimics Rocket Pool’s branding to deceive visitors into configuring fake node software, potentially stealing wallet credentials or ETH deposits. The threat actor leverages Cloudflare’s hosting and a Google Trust Services SSL certificate to appear legitimate, resolving to IP 172.66.47.179. This domain remains undetected by security engines, with VirusTotal showing 1/95 detections, indicating a low immediate detection rate despite its malicious intent. The domain was registered through Cloudflare, Inc., a common tactic among threat actors to obscure ownership and evade takedowns. Due to the use of Cloudflare Pages and a trustworthy SSL issuer, users may unknowingly trust the site unless they verify the domain path (.pages.dev) or check for official Rocket Pool URLs. Users who visited www-rocketpool.pages.dev should immediately disconnect from the site, scan their devices for malware, and avoid entering any credentials or cryptocurrency wallet information. Report the domain to your security team and verify the official Rocket Pool website (rocketpool.net) for accurate node setup instructions. If you interacted with this page, revoke any exposed API keys or wallet access permissions and monitor accounts for unauthorized transactions.