allroadsleadtorome[.]xyz

Allroadsleadtorome.xyz was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). The domain is fronted by Cloudflare, utilizes HTTP/3, and presents an SSL certificate issued by Google Trust Services under the WE1 trust chain. The page title returned by the now‑offline site is “ROME”, and the authoritative name servers are chin.ns.cloudflare.com and conrad.ns.cloudflare.com. VirusTotal analysis shows that eight of ninety‑three scanning engines flagged the domain as malicious, indicating a consensus of moderate detection confidence.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing its classification as a phishing vector. Infrastructure evidence suggests the attacker leveraged Cloudflare’s CDN to hide the true origin, a common tactic for phishing campaigns seeking resilience against takedown. The use of a generic page title and the lack of additional visible content in the collected metadata limit the ability to attribute a specific phishing lure or target brand beyond the generic “ROME” label.

Uncertainty remains regarding the exact payload delivered to victims, the phishing kit employed, and any compromised credential harvesting mechanisms, as no page content or network traffic captures have been released. Defenders should therefore treat the domain as a confirmed phishing source and incorporate the IP address 188.114.97.3 and the associated hostnames into outbound filtering rules, DNS sinkhole configurations, and threat‑intel feeds. Continuous monitoring of Cloudflare‑originated IP ranges for similar registrations, and periodic re‑scanning of the domain if it becomes active again, are recommended to maintain coverage.