romacas[.]com

The domain romacas.com has been identified as a brand impersonation threat specifically targeting the Ethereum cryptocurrency ecosystem. Currently classified as elevated risk, this domain has been taken offline, but it posed a significant danger to users seeking legitimate Ethereum-related services. The site presented itself under the page title "ROMACAS | Enter the world of sport and stakes!" which is inconsistent with its claimed association, suggesting an attempt to lure visitors through unrelated interests while harvesting credentials or funds.

Technical analysis reveals that romacas.com was registered on October 26, 2025, through Dominet (HK) Limited and resolved to IP address 57.129.97.29. It appears on one security blocklist and has no SSL certificate, indicating a lack of basic security measures. VirusTotal flagged the domain with 2 out of 95 security vendors marking it as malicious, confirming suspicious activity. The domain was created relatively recently, which is typical for phishing campaigns that rely on short-lived domains to evade detection.

Given that the domain is now offline, the immediate risk is reduced, but users who may have interacted with it should monitor their accounts for unauthorized access. PhishDestroy recommends avoiding any unsolicited links claiming to be from Ethereum or related services and verifying official URLs directly. For anyone who visited romacas.com, changing passwords and enabling two-factor authentication on associated accounts is advised. Continued vigilance is necessary as similar domains may appear under different names.