t3rn[.]lol

Analysis of t3rn.lol indicates that the domain was registered on 21 February 2026 and subsequently used for a crypto‑related brand impersonation campaign targeting Metamask users. The site presented a page titled “BRN to TRN Claim”, which aligns with the reported scam type of a crypto scam. The domain resolves to IP address 172.67.137.122, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented for the site is identified as “WE1”, confirming that HTTPS was served during its brief online period. Threat intelligence aggregators have recorded the domain on a single security blocklist, and it is explicitly listed as blocked by PhishDestroy.

VirusTotal scans returned five positive detections out of ninety‑three participating security vendors, indicating that a minority of scanners flagged the domain as malicious. The site’s current status is offline, limiting the ability to capture additional artifacts such as HTTP response headers, JavaScript payloads, or credential‑harvesting forms. Consequently, the full scope of the phishing infrastructure, including any associated command‑and‑control servers or downstream URLs, remains uncertain. Defenders should incorporate the domain indicator into existing URL filtering and DNS sinkhole policies, treating any future resolution of t3rn.lol as malicious. Network monitoring should alert on connections to the associated Cloudflare IP, especially if the traffic originates from internal hosts that have previously accessed cryptocurrency wallet services.

Although only one blocklist currently references the domain, the presence of multiple vendor detections on VirusTotal suggests a non‑trivial risk. Continuous re‑evaluation is advised, as the threat actor may reactivate the domain or reuse the same hosting arrangement for new campaigns.