trovemarket[.]pro

The domain trovemarket.pro was registered on April 21, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. It presents a TLS certificate from Let’s Encrypt (E8) and resolves to the Cloudflare IP address 104.21.64.216, which is geolocated to Canada. HTTP requests return a 200 status code and the page title "Trove Markets • Claim $TROVE". Gridinsoft assigns a trust score of 0/100, indicating a high likelihood of malicious intent. VirusTotal has flagged the domain by 1 of 94 security vendors, and it appears on a single security blocklist. AlienVault OTX references the domain in one threat intelligence pulse, and PhishDestroy has listed it as blocked. Nameservers are noor.ns.cloudflare.com and armfazh.ns.cloudflare.com. While the exact phishing payload or credential harvesting mechanisms have not been publicly observed, the combination of a brand‑like page title, low trust rating, and detection by multiple security services suggests a high‑risk generic phishing campaign. Defenders should block the domain at network perimeter devices, monitor DNS queries for the associated IP and nameservers, and update endpoint detection rules to flag any connections to trovemarket.pro. Ongoing observation is advised to capture any emerging malicious activity.