register-trumpcoin[.]com

Analysis shows that register-trumpcoin.com was registered on May 01, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted on a Cloudflare edge node (IP 172.67.133.138) located in Canada. The domain resolves to the same IP and uses Cloudflare’s default nameservers james.ns.cloudflare.com and meiling.ns.cloudflare.com. An SSL certificate issued by Let’s Encrypt (identifier E8) is present, but the HTTP response returns a 403 status code, indicating that the site blocks direct access while likely serving malicious content to targeted browsers.

Threat intelligence sources reinforce the malicious profile. AlienVault OTX lists the domain in a single pulse, and PhishDestroy has already blocked it. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external security blocklist. VirusTotal analysis flags the domain by one of ninety‑five security vendors, providing additional confirmation of suspicious activity.

While the 403 response prevents immediate inspection of the payload, the combination of a newly created domain, low trust score, presence on a blocklist, and a single vendor flag suggests a high‑confidence phishing operation targeting users interested in “TrumpCoin.” The lack of additional public detections or broader vendor consensus creates uncertainty about the full scope of the campaign, the specific lure used, and whether the site is part of a larger infrastructure.

Defenders should add register-trumpcoin.com to network deny lists and enforce DNS filtering to prevent resolution. Continuous monitoring of the associated IP address (172.67.133.138) and the Cloudflare nameservers is advised, as any change could indicate migration to new malicious hosts. Updating local blocklists with the latest OTX pulse and VirusTotal findings will help maintain coverage. Given the high risk rating, active surveillance and incident response playbooks for credential‑stealing attempts should be ready for deployment.