claimrocafi[.]net

claimrocafi.net was registered on 21 February 2026 through Hostinger Operations, UAB. The domain resolves to 84.32.84.107, an address owned by AS47583 Hostinger International Limited and geolocated to Lithuania. Authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com, typical of parked or quickly provisioned domains. The site is currently offline, returning no HTTP response, and no TLS certificate is presented, indicating an unencrypted service.

The page title retrieved before takedown was “Roca Finance - Stake ROCA Tokens on BSC | Earn up to 100% APY”, which aligns with a crypto‑staking narrative and matches the classified scam type “Crypto Scam”. The domain is listed on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reflecting consensus among threat‑intelligence feeds. VirusTotal scans show three of ninety‑three vendors flagging the domain, reinforcing the malicious assessment despite the limited detection count. No evidence of Safe Browsing or Open Threat Exchange entries is available in the provided data.

The impersonated brand is identified as “Fake Staking”, suggesting the actors aim to lure victims seeking staking services. Given the combination of recent registration, hosting on a shared provider, lack of encryption, and presence on multiple blocklists, defenders should add the domain and its IP address to network deny lists, monitor for additional domains resolving to the same host, and enforce TLS inspection to detect any future activation. Continuous observation of Hostinger‑assigned IP ranges for similar naming patterns is recommended, as the infrastructure is conducive to rapid deployment of additional fraudulent sites. Uncertainty remains regarding the exact payload or phishing page content, as the site was taken offline before a full content capture could be performed.