trojanbot[.]space

This domain, trojanbot.space, is flagged as a cryptocurrency phishing threat with an elevated risk level. Analysis indicates it is designed to deceive users into disclosing wallet credentials or executing malicious transactions, likely targeting cryptocurrency holders. The domain exhibits characteristics consistent with crypto drainer schemes, where victims are tricked into connecting wallets to fraudulent interfaces, resulting in unauthorized fund transfers. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolves to the IP address 186.2.175.35. It is currently offline but was previously active under DDoS-Guard protection, a service often abused by malicious actors to obfuscate hosting origins. VirusTotal detections show 6 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is referenced in two AlienVault OTX threat intelligence pulses. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious nature. The page title, 'Website trojanbot.space is ready. The content is to be added,' suggests the domain was either in a preparatory phase or intentionally left vague to avoid early detection. Mitigation steps for this threat include immediate blocking of the domain and its associated IP address (186.2.175.35) at the network perimeter. Organizations should update endpoint protection rules to flag interactions with this domain and monitor for any attempts to access it. Cryptocurrency users should be advised to verify wallet addresses and avoid connecting wallets to unfamiliar or untrusted websites. Security teams should review logs for any historical connections to the domain or IP, particularly from systems involved in cryptocurrency transactions. If the domain resurfaces, further analysis of its content and behavior is recommended to identify additional indicators of compromise.