get-trolololo[.]app

The domain get-trolololo.app was observed pointing to the IP address 172.67.143.185, an endpoint owned by Cloudflare (AS13335) located in the United States. The site has been taken offline, preventing direct verification of its content, but the available metadata provides sufficient indicators of malicious intent. Registration records show the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with no nameserver information disclosed. The hosting environment lacks an SSL/TLS certificate, indicating the site was served over plain HTTP and suggesting a low‑cost, rapid‑deployment infrastructure.

Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating, reinforcing the high‑risk classification. The page title returned by the server is "trololololololol," which does not correspond to any legitimate Instagram branding and aligns with the reported impersonation of Instagram. The threat is catalogued as a wallet/seed phishing campaign, implying attempts to harvest cryptocurrency recovery phrases or private keys from victims who believe they are interacting with Instagram‑related services. VirusTotal analysis recorded a single detection out of 95 security vendors, and the domain is listed on at least one public security blocklist.

PhishDestroy has also taken action to block the domain. Defenders should immediately add get-trolololo.app to local and network‑level blocklists, monitor DNS queries for the associated IP and any newly observed subdomains, and enforce email security controls to filter messages that reference Instagram credential or seed‑phrase collection. Continuous threat‑intel feeds should be consulted for emerging domains that share the same registration patterns or host infrastructure, as the offline status does not preclude future re‑deployment of the campaign.