approcketpool[.]xyz

This domain, approcketpool.xyz, is identified as a phishing resource engaging in brand impersonation targeting Rocket Pool, a decentralized Ethereum staking protocol. Analysis indicates the site mimics legitimate Rocket Pool interfaces to deceive users into disclosing wallet credentials or authorizing malicious smart contracts, consistent with crypto drainer tactics. No explicit drainer kit signatures were observed, but the page title 'Just a moment...' suggests Cloudflare protection, a common evasion technique in phishing infrastructure. Infrastructure analysis reveals the domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.26.120, part of Cloudflare’s network, which is often leveraged to obscure backend hosting. Detection metrics show 6 out of 95 security vendors flagged the domain on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is currently classified as offline. Google Safe Browsing status was not explicitly provided, but the presence of Cloudflare and the low detection rate suggest limited prior exposure. The domain has been taken offline, likely due to enforcement actions by security blocklists or hosting providers. However, residual risk persists due to the domain’s recent registration and the use of a high-reputation registrar and CDN. Organizations and users are advised to monitor for re-registration or similar domains under the same registrar. Network-level blocking of the IP 104.21.26.120 may mitigate exposure to related threats. Continuous scanning for brand impersonation patterns and wallet interaction anomalies is recommended to detect follow-up campaigns.