trolltoken[.]org

The domain trolltoken.org was registered on May 03, 2026 through Key-Systems GmbH and is currently active. The site serves a single page that returns HTTP status 200 and displays the title “Just a moment…”. The visual appearance and URL structure are crafted to resemble the legitimate OKX platform, indicating a high‑risk brand impersonation campaign aimed at credential harvesting or cryptocurrency fraud. Infrastructure analysis shows the domain is hosted behind Cloudflare’s network, resolving to IP address 188.114.97.3 located in Canada and presenting a Let’s Encrypt certificate (E7). Authoritative nameservers are diana.ns.cloudflare.com and johnny.ns.cloudflare.com, both typical of Cloudflare‑managed zones. The low Gridinsoft trust score of 0/100 further suggests a malicious intent. Threat intelligence corroborates the malicious nature of the domain. AlienVault OTX includes the domain in one pulse, and VirusTotal records two out of ninety‑five security vendors flagging it as suspicious. The domain appears on three external blocklists and is already blocked by multiple mitigation services, including PhishDestroy, MetaMask, and SEAL. While the current landing page provides limited interaction, the presence of a legitimate‑looking OKX brand logo and the “Just a moment…” placeholder are common tactics to lure users while background scripts potentially capture credentials or redirect traffic. The exact payload or secondary infrastructure has not been observed, leaving the full scope of the campaign uncertain. Defenders should add trolltoken.org to DNS and URL filtering rules, enforce TLS inspection to detect the Let’s Encrypt certificate, and monitor for any outbound connections to the Cloudflare IP address 188.114.97.3. Continuous threat‑intel feeds should be consulted for updates, and any user reports of OKX‑related login prompts should be investigated promptly.