# trumpcoins.blog — SUSPICIOUS

> Stay cautious with trumpcoins.blog. Though no detections yet, this newly created domain shows phishing traits and is under active investigation.

## Summary
PhishDestroy identifies trumpcoins.blog as a potentially harmful domain exhibiting generic phishing behavior. Despite lacking current detections from major security vendors, its recent creation date and suspicious naming pattern suggest it may be used to deceive users. As phishing campaigns often exploit newly registered domains to evade detection, caution is warranted.

Technically, trumpcoins.blog was registered through NameSilo, LLC on March 4, 2026, and currently resolves to the IP address 104.21.1.248, which belongs to a content delivery network commonly used to mask hosting locations. VirusTotal scans reveal zero detections thus far, but ongoing activity and the domain’s infrastructure details align with typical phishing setups. No additional threat intelligence, such as blocklist entries or OTX pulses, has been observed, indicating this threat is still under active analysis.

At present, trumpcoins.blog remains active and under investigation by PhishDestroy analysts. Users and organizations are advised to avoid interacting with this domain until further clarity emerges. Security teams should monitor this domain for suspicious activity and consider blocking access preemptively. Continued surveillance and updated threat intelligence will be critical to determine if this domain evolves into a confirmed phishing threat.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Scam type: Airdrop Scam
- Page title: OFFICIAL TRUMP | Airdrop

## Domain Intelligence
- Registered: 2026-03-07 03:07:01
- Registrar: NameSilo, LLC
- Country: US
- IP: 104.21.1.248
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: amos.ns.cloudflare.com dayana.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["Gridinsoft", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://i.ibb.co/KzwpzQS7/206c1243c5fc.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/f82c2b60-9c32-4a90-95cf-9ea2ce391f8f
- Wayback Machine: https://web.archive.org/web/https://trumpcoins.blog
- PhishDestroy: https://phishdestroy.io/domain/trumpcoins.blog/
- LLM endpoint: https://phishdestroy.io/domain/trumpcoins.blog/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/trumpcoins.blog/
Last updated: 2026-03-19