trololol[.]site

The domain trololol.site was registered on February 21, 2026 through Web Commerce Communications Limited dba WebNic.cc and is currently offline. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served by the authoritative nameservers ns100.webnic.cc and ns101.webnic.cc. An SSL certificate labeled WE1 is present, indicating that HTTPS was enabled at some point.

The page title retrieved from the site is "trololololololol", and the campaign is classified as social media phishing that impersonates Instagram. The infrastructure has been listed on two security blocklists, PhishDestroy and ScamSniffer, providing external confirmation of malicious intent. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of abuse. VirusTotal analysis shows that one of ninety‑five security vendors flagged the domain, reinforcing the suspicion.

Given the combination of brand impersonation, the presence on blocklists, a zero‑trust score, and a flagged vendor detection, defenders should treat trololol.site as a confirmed malicious actor. Recommended mitigation steps include adding the domain and its resolving IP to firewall deny lists, updating URL filtering policies to block content from the identified blocklists, and monitoring for any new domains registered with the same registrar or using the same nameserver pair. Because the IP is part of a shared Cloudflare network, broader blocklisting of the address may affect legitimate services; therefore, domain‑level blocking is preferred. Continuous ingestion of threat intelligence feeds that reference the PhishDestroy and ScamSniffer identifiers will help surface any resurgence of the campaign, and analysts should watch for similar page titles or SSL certificate patterns that could indicate reuse of the same toolset.