rolvip[.]com

Analysis conducted on July 23 2026 identifies rolvip.com as an offline domain that has been used for a brand‑impersonation operation targeting Ethereum. The site returned HTTP 200 before being taken offline and presented the page title “ROLVIP | Enter the world of sport and stakes!”. Its SSL certificate is issued to XUI.one, which does not match the domain name, indicating a mismatched certificate often seen in fraudulent deployments. DNS resolution points to 57.129.97.29, an address hosted by OVH SAS in Germany under ASN 16276.

The registrar record shows the domain was created on August 13 2025 via PDR Ltd. d/b/a PublicDomainRegistry.com. VirusTotal scans recorded 11 detections out of 95 security vendors, and the domain appears on one external blocklist. PhishDestroy has already blocked the domain, and Gridinsoft assigns a trust score of 6 / 100, reflecting a high likelihood of malicious intent. The operation is categorized as a crypto scam and employs the Gambler Scam phishing kit, which is commonly used to lure victims with gambling‑related narratives while masquerading as legitimate cryptocurrency services.

The domain explicitly impersonates the Ethereum brand, suggesting attempts to harvest credentials or funds from users seeking Ethereum‑related services. Current evidence does not reveal the exact payload or credential‑capture mechanism because the site is offline, leaving the specific victim‑interaction flow uncertain. Defenders should add rolvip.com to URL filtering and DNS blocklists, monitor traffic to its hosting IP, and enforce TLS inspection to detect mismatched certificates. Continued observation of related IP ranges and the Gambler Scam kit indicators is advised to pre‑empt further campaigns that may reuse the same infrastructure.