interface-rocketpool[.]xyz

This domain, interface-rocketpool.xyz, is actively flagged as a high-risk brand impersonation threat targeting Rocket Pool, a known decentralized Ethereum staking protocol. Registered on April 14, 2026, through Dynadot LLC, the domain currently resolves to IP address 104.21.47.61, hosted behind Cloudflare infrastructure in Canada. Analysis of its nameservers—duke.ns.cloudflare.com and olivia.ns.cloudflare.com—confirms Cloudflare as the DNS provider, while its SSL certificate, issued by Google Trust Services (WE1), remains valid. The domain returns an HTTP 403 status with the page title 'Just a moment...', a common Cloudflare interstitial response, which may indicate automated filtering or recent takedown attempts. Infrastructure evidence reveals the domain has been detected by 13 of 94 security vendors on VirusTotal, and it appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX has also recorded the domain in at least one threat intelligence pulse. Despite these indicators, the domain remains active as of July 12, 2026, with no confirmed takedown or sinkholing observed. Gridinsoft assigns it a trust score of 0/100, reinforcing its classification as malicious. While the exact content of the phishing page is not yet analyzed, the domain’s naming convention—combining 'interface' with 'rocketpool'—strongly suggests an intent to deceive users into interacting with a fraudulent interface mimicking Rocket Pool’s legitimate platform. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where Rocket Pool or similar staking services are in use. Further monitoring is recommended to track any shifts in hosting or SSL certificate changes, which may signal evasion attempts.