roc-avoirival[.]com

Analysis of the domain roc-avoirival.com confirms its classification as an active phishing site targeting Bitcoin users. Registered on May 24, 2026, through NETIM, the domain resolves to the IP address 103.109.100.253. As of July 12, 2026, the site remains operational, presenting itself with the page title 'Plateforme Roc Avoirival | Site officiel,' which explicitly impersonates a cryptocurrency platform. Security vendors have flagged the domain, with 12 out of 95 detections on VirusTotal, and it appears on four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. The domain is also referenced in 17 threat intelligence pulses on AlienVault OTX, further corroborating its malicious nature. Infrastructure analysis reveals the use of Nginx as the web server and Unpkg for additional resources. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The Gridinsoft trust score of 0/100 aligns with its high-risk classification. While the exact content and mechanics of the phishing scheme are not yet fully analyzed, the domain's association with Bitcoin impersonation and its presence on multiple blocklists indicate a deliberate attempt to deceive users into divulging sensitive information or transferring cryptocurrency. Defenders should treat this domain as confirmed malicious infrastructure. Network-level blocking of the IP address 103.109.100.253 and the domain roc-avoirival.com is recommended to mitigate exposure. Organizations should also monitor for any internal connections to this infrastructure and review logs for potential compromise. Given its active status and consistent detection across security platforms, this domain poses a credible threat to users engaging with cryptocurrency services.