romm[.]world

This domain is flagged as infrastructure used for cryptocurrency wallet credential harvesting, a tactic designed to deceive users into disclosing private keys or recovery phrases. Analysis indicates the site mimics legitimate wallet interfaces to capture sensitive authentication details, which are then exfiltrated to attacker-controlled endpoints for unauthorized fund transfers or account takeovers. The threat specifically targets users of decentralized finance platforms and self-custody wallets, where credential compromise leads to immediate and irreversible asset loss. Infrastructure analysis reveals the domain romm.world was registered on June 08, 2026, through a large commercial registrar. Despite its recent creation, it has already been added to 4 security blocklists, including those maintained by cryptocurrency security teams. VirusTotal reports 0 detections out of 95 engines, suggesting the site employs evasion techniques such as dynamic content generation or cloaking. The domain was observed in 4 threat intelligence pulses on a major open-source threat exchange platform, indicating active tracking by security researchers. Its SSL certificate, issued by a widely trusted provider, further obscures its malicious nature from casual inspection. Users who visited romm.world or entered credentials on the site should immediately revoke access to any connected wallet applications and transfer assets to a new, secure wallet. All devices used to access the site should undergo a full malware scan using updated detection tools. Recovery phrases or private keys exposed to this domain must be considered compromised and should never be reused. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where supported. Security teams are advised to add romm.world to internal blocklists and alert users to this credential-harvesting campaign.