dev[.]stake-rocketpooi[.]net

The domain dev.stake-rocketpooi.net was registered on February 21, 2026 and is currently listed as offline. DNS resolution points to the IP address 186.2.162.247, which is attributed to ASN AS59692 operated by IQWeb FZ-LLC in Belize. The site presents an SSL certificate identified as R11; no further certificate metadata is available, but the presence of a certificate suggests the host attempted to secure HTTPS traffic. The page title returned from the server is "Stake - Rocket Pool," directly referencing the legitimate staking service offered by Rocket Pool.

This title, combined with the declared impersonation of Rocket Pool and the classification as a crypto scam, indicates the domain is intended to lure users seeking legitimate staking operations. The domain appears on a single security blocklist and is specifically blocked by PhishDestroy, confirming that at least one commercial threat‑intelligence vendor has flagged the site as malicious. VirusTotal analysis shows six of ninety‑three scanning engines flagged the domain, providing additional corroboration of malicious intent. While the exact content of the landing page has not been captured, the available data points—brand impersonation, crypto‑related scam labeling, blocklist inclusion, and multi‑engine detection—suggest a high likelihood that the domain was used for credential harvesting or financial deception targeting Rocket Pool users.

Defenders should continue to block the domain at network perimeter devices, update local DNS blocklists, and monitor for any DNS queries to 186.2.162.247 that may originate from internal hosts. Threat‑intel teams should correlate any observed traffic with known Rocket Pool phishing campaigns and consider notifying Rocket Pool security channels. Because the site is offline, active harvesting is presumably halted, but the infrastructure may be repurposed for future campaigns; continuous monitoring of the associated IP range and ASN is recommended.