troll-claims[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically targeting Coinbase. Analysis indicates the site mimics legitimate cryptocurrency distribution pages, as evidenced by the page title '$TROLL Distribution,' which aligns with known fraudulent token claim schemes. The domain's infrastructure and content are designed to deceive users into disclosing credentials or transferring assets under false pretenses. Infrastructure analysis reveals the following technical indicators: VirusTotal detection rate of 2/95 security vendors, registration through NiceNIC International Group Co., Limited on September 21, 2025, and resolution to IP address 188.114.96.3. The domain appears on 2 security blocklists and is assigned a trust score of 0/100 by Gridinsoft. Additionally, it has been blocked by at least two independent threat intelligence feeds, further confirming its malicious classification. The recent creation date and low detection rate suggest an attempt to evade automated defenses. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (188.114.96.3) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, web proxies, and email gateways to prevent user interaction. User awareness training should emphasize verifying domain authenticity before engaging with cryptocurrency distribution pages, particularly those using unofficial branding or urgent claims. Monitoring for similar domains registered through the same registrar (NiceNIC International Group Co., Limited) may help identify related threats.